CVE-2026-34035: Coolify Command Injection RCE Vulnerability

CVE-2026-34035 Overview

Coolify is an open-source, self-hostable platform for managing servers, applications, and databases. CVE-2026-34035 is a command injection vulnerability [CWE-78] affecting Coolify versions prior to 4.0.0-beta.466. The flaw resides in the log drain configuration workflow, where secret values and environment variables were interpolated directly into shell commands without sufficient encoding. An authenticated user can inject arbitrary commands that execute on the underlying host running Coolify. The vendor released a fix in version 4.0.0-beta.466.

Critical Impact
Authenticated attackers can execute arbitrary operating system commands on the Coolify host, leading to full compromise of managed servers, applications, and databases.

Affected Products

Coolify versions prior to 4.0.0-beta.466
Self-hosted Coolify deployments with log drain functionality accessible to authenticated users
All log drain integrations (New Relic, Highlight, Axiom, and custom types) using the vulnerable configuration path

Discovery Timeline

2026-07-07 - CVE-2026-34035 published to NVD
2026-07-07 - Last updated in NVD database

Technical Details for CVE-2026-34035

Vulnerability Analysis

The vulnerability is a classic OS command injection [CWE-78] in the log drain configuration handler. Coolify constructs shell command arrays containing user-controlled values such as license keys, dataset names, API keys, and base URIs. These values are interpolated directly into shell strings using PHP string interpolation. An authenticated user who can modify log drain settings can insert shell metacharacters (for example ;, `, $(), or newlines) into fields such as the New Relic license key or the Axiom API key. When Coolify executes the assembled command on the host, the injected payload runs with the privileges of the Coolify service.

Because Coolify manages Docker, applications, and databases on the host, code execution translates directly into full server compromise. The attack requires network access and low-privilege authentication.

Root Cause

The root cause is unsafe construction of shell commands. User-supplied environment values were embedded into echo statements using PHP variable interpolation without escaping or encoding. There was also no strict input validation on fields such as logDrainNewRelicLicenseKey, logDrainAxiomDatasetName, and logDrainAxiomApiKey, allowing shell metacharacters through the application layer.

Attack Vector

An authenticated user with permission to configure log drains submits a crafted value in a log drain settings field. On save, Coolify assembles and executes a shell command on the server containing the malicious value, resulting in host-level command execution.

php

// Vulnerable pattern (pre-patch) in app/Actions/Server/StartLogDrain.php
// User-controlled values interpolated directly into shell commands
$add_envs_command = [
    "echo LICENSE_KEY=$license_key >> $config_path/.env",
    "echo BASE_URI=$base_uri >> $config_path/.env",
];
// A payload such as: value\n$(malicious_command) results in injection.

Source: GitHub Commit fcd574e

Detection Methods for CVE-2026-34035

Indicators of Compromise

Unexpected child processes spawned by the Coolify PHP or worker process, particularly shells (sh, bash) executing commands unrelated to log drain setup.
Anomalous modifications to files under the log drain config_path, including unexpected .env file contents or additional files.
Outbound network connections initiated by the Coolify host immediately after log drain configuration changes.
Log drain configuration entries containing shell metacharacters such as `, $(, ;, |, or embedded newlines.

Detection Strategies

Audit Coolify application logs and database records for log drain fields containing non-alphanumeric characters outside the allowed set [a-zA-Z0-9_\-\.].
Monitor process ancestry on the Coolify host to identify shell invocations descended from the Coolify service that do not match the expected mkdir, echo, tee, or test commands.
Enable file integrity monitoring on the log drain configuration directory to detect tampering.

Monitoring Recommendations

Alert on any process launched by Coolify that is not on an expected allowlist (docker, mkdir, echo, tee, base64, rm, test).
Correlate log drain configuration change events with subsequent process execution and outbound network telemetry.
Track authentication events for accounts with permission to modify server or log drain settings.

How to Mitigate CVE-2026-34035

Immediate Actions Required

Upgrade Coolify to version 4.0.0-beta.466 or later immediately.
Review all existing log drain configurations for suspicious values containing shell metacharacters and reset them if any are found.
Rotate any secrets (license keys, API keys) previously stored in Coolify log drain settings, as they may have been exposed.
Restrict access to the Coolify administrative interface to trusted users and networks.

Patch Information

The fix is available in Coolify v4.0.0-beta.466. The patch base64-encodes environment variable content before writing it to disk via shell, avoiding direct interpolation, and adds strict regex validation (/^[a-zA-Z0-9_\-\.]+$/) to sensitive fields. See the GitHub Security Advisory GHSA-3xm2-hqg8-4m2p and the commit details for the full change set.

php

// Post-patch validation added in app/Livewire/Server/LogDrains.php
#[Validate(['string', 'nullable', 'regex:/^[a-zA-Z0-9_\-\.]+$/'])]
public ?string $logDrainNewRelicLicenseKey = null;