CVE-2026-34038: Coolify RCE Vulnerability

CVE-2026-34038 Overview

Coolify is an open-source, self-hostable platform for managing servers, applications, and databases. CVE-2026-34038 is an authenticated remote command injection vulnerability [CWE-78] in Coolify's application deployment handling. Users with application write permissions can inject commands through fields such as dockerfile_location and other deployment parameters. Successful exploitation achieves remote code execution on the Coolify host and exfiltrates sensitive environment variables through deployment logs. The issue affects all versions prior to 4.0.0-beta.469 and is fixed in that release.

Critical Impact
Authenticated attackers with application write permissions can execute arbitrary OS commands on the Coolify server, exfiltrate secrets via deployment logs, and pivot into managed infrastructure.

Affected Products

Coolify versions prior to 4.0.0-beta.469
Self-hosted Coolify deployments exposing the application management API
Multi-tenant Coolify instances granting application write permissions to non-admin users

Discovery Timeline

2026-07-06 - CVE-2026-34038 published to NVD
2026-07-07 - Last updated in NVD database

Technical Details for CVE-2026-34038

Vulnerability Analysis

Coolify's application update API accepts a list of deployment-related fields and passes several of them into shell contexts during build and deployment operations. Fields such as dockerfile_location, pre-deployment commands, and post-deployment commands were not sanitized against shell metacharacters. An authenticated user with the update permission on an application could inject shell operators into these fields. When the deployment pipeline executed, the injected payload ran as the Coolify service account on the destination server. Because Coolify orchestrates Docker builds and reads secrets from environment variables, an attacker could reflect environment values into deployment logs and retrieve them through the standard API.

Root Cause

The root cause is missing input validation on deployment fields that are later concatenated into shell commands. The patched code in app/Support/ValidationPatterns.php introduces a NAME_PATTERN regular expression that excludes dangerous characters, and the controller in app/Http/Controllers/Api/ApplicationsController.php tightens the allowed field list and validation rules for dockerfile_location and the new dockerfile_target_build field.

Attack Vector

Exploitation requires network access to the Coolify API and an authenticated account with application write permissions. The attacker sends a crafted update request containing shell metacharacters in a deployment field. On the next build or deployment, Coolify passes the tainted value to a shell, executing the attacker's commands under the deployment context.

php

// Patch excerpt: app/Http/Controllers/Api/ApplicationsController.php
// Adds `dockerfile_target_build` to the allowed field list, alongside
// tightened validation for deployment-related inputs.
$allowedFields = [
    /* ... */
    'dockerfile_location',
    'dockerfile_target_build', // newly added and validated
    'docker_compose_location',
    /* ... */
];
// Source: https://github.com/coollabsio/coolify/commit/23f9156c7306b221101f1ebbe4d3c6b5e2522acd

php

// Patch excerpt: app/Support/ValidationPatterns.php
// Restricts names/identifiers to a safe Unicode character set,
// excluding shell metacharacters used for command injection.
public const NAME_PATTERN = '/^[\p{L}\p{M}\p{N}\s\-_.@\/&]+$/u';
// Source: https://github.com/coollabsio/coolify/commit/23f9156c7306b221101f1ebbe4d3c6b5e2522acd

Detection Methods for CVE-2026-34038

Indicators of Compromise

Unexpected shell metacharacters (;, |, `, $() in Coolify application configuration fields such as dockerfile_location or pre/post-deployment commands.
Deployment logs containing environment variable values or output from commands like env, cat /etc/passwd, or curl to external hosts.
Outbound network connections from the Coolify host or build containers to unfamiliar destinations during deployment windows.
Coolify API PATCH/PUT requests to application endpoints followed immediately by deployment triggers from the same user.

Detection Strategies

Audit the Coolify database and API for application records whose deployment fields contain shell control characters outside the allowed NAME_PATTERN.
Correlate authenticated API activity with subsequent process execution on the Coolify host to identify user-driven command execution paths.
Monitor deployment log content for patterns resembling secret exfiltration such as base64 blobs, AWS_, DATABASE_URL, or SECRET_ variable names.

Monitoring Recommendations

Enable and centralize Coolify application and deployment audit logs, retaining them long enough to investigate abuse of write permissions.
Alert on non-admin accounts editing dockerfile_location, pre_deployment_command, or post_deployment_command fields.
Track child processes spawned by the Coolify build worker and flag shells invoked with unusual arguments.

How to Mitigate CVE-2026-34038

Immediate Actions Required

Upgrade all Coolify instances to version 4.0.0-beta.469 or later without delay.
Rotate any secrets, API tokens, and environment variables that were accessible to Coolify deployments prior to patching.
Review the list of users with application write permissions and remove access that is not strictly required.
Inspect existing application records for injected payloads in deployment fields and sanitize or recreate affected applications.

Patch Information

The vulnerability is fixed in Coolify v4.0.0-beta.469. The fix commit 23f9156 adds strict validation patterns and tightens allowed deployment fields. See the GitHub Security Advisory GHSA-qqrq-r9h4-x6wp and the pull request discussion for additional context.

Workarounds

Restrict network access to the Coolify API so that only trusted administrators can reach application management endpoints until patching is complete.
Temporarily downgrade user roles to remove application write permissions from any account that does not require them.
Place the Coolify host behind a reverse proxy that logs and rate-limits API changes to deployment fields.

bash

# Upgrade Coolify to the patched release
cd /data/coolify/source
curl -fsSL https://cdn.coollabs.io/coolify/install.sh | bash

# Verify the running version is >= 4.0.0-beta.469
docker inspect coolify --format '{{ .Config.Image }}'