CVE-2026-34047: Coolify Auth Bypass Vulnerability

CVE-2026-34047 Overview

Coolify is an open-source, self-hostable platform for managing servers, applications, and databases. CVE-2026-34047 is a broken access control vulnerability [CWE-863] affecting Coolify versions prior to 4.0.0-beta.471. The terminal WebSocket bootstrap routes failed to enforce the expected authorization middleware. An authenticated user could access terminal functionality for resources outside their authorized scope and potentially execute commands on those resources. The maintainers fixed this issue in version 4.0.0-beta.471 by applying the can.access.terminal middleware to the affected routes.

Critical Impact
An authenticated low-privilege user can reach terminal WebSocket endpoints for out-of-scope servers, applications, and databases, enabling arbitrary command execution across tenant boundaries in shared Coolify deployments.

Affected Products

Coolify versions prior to 4.0.0-beta.471
Self-hosted Coolify deployments exposing terminal WebSocket routes
Multi-tenant Coolify instances shared across teams or users

Discovery Timeline

2026-07-07 - CVE-2026-34047 published to NVD
2026-07-07 - Last updated in NVD database

Technical Details for CVE-2026-34047

Vulnerability Analysis

Coolify exposes browser-based terminal sessions to servers and containers through WebSocket bootstrap routes defined in routes/web.php. These routes negotiate the terminal session, authenticate the requesting user, and issue tokens or connection metadata used by the WebSocket handler. The bootstrap routes verified that a session was authenticated, but they did not verify that the authenticated user was authorized to reach the specific resource being requested.

Because authorization was enforced only for UI navigation and not at the terminal bootstrap layer, any authenticated Coolify user could invoke the bootstrap endpoints directly with identifiers of resources belonging to other teams. The bootstrap would return a valid terminal handle. Subsequent WebSocket traffic could then execute commands against the out-of-scope server or container.

Root Cause

The root cause is a missing authorization check on the terminal.auth route and adjacent terminal bootstrap endpoints. The route pipeline included auth()->check() but omitted the can.access.terminal middleware that enforces per-resource ownership. This is a classic authorization gap [CWE-863] where an authenticated identity is conflated with an authorized subject.

Attack Vector

An attacker with any valid Coolify account on a shared or multi-team instance can send crafted requests to the terminal bootstrap endpoints with resource identifiers they do not own. After the bootstrap succeeds, the attacker upgrades to the WebSocket channel and issues shell commands to the targeted server, application container, or database instance.

php

// Patch: routes/web.php - apply authorization middleware to terminal bootstrap
         }

         return response()->json(['authenticated' => false], 401);
-    })->name('terminal.auth');
+    })->name('terminal.auth')->middleware('can.access.terminal');

     Route::post('/terminal/auth/ips', function () {
         if (auth()->check()) {

Source: GitHub Commit bc91b41

The patch attaches the can.access.terminal middleware to the terminal.auth route so that authorization is verified before a terminal session handle is issued.

Detection Methods for CVE-2026-34047

Indicators of Compromise

Requests to /terminal/auth or /terminal/auth/ips from user sessions that do not own the referenced resource identifier
WebSocket upgrade events targeting terminal endpoints for servers or applications outside the requesting user's team scope
Shell command execution on managed servers correlated with Coolify user accounts that lack a legitimate assignment to that host
Unexpected spikes in successful terminal bootstrap responses from low-privilege accounts

Detection Strategies

Review Coolify application logs and web server access logs for POST requests to terminal bootstrap routes and cross-reference the acting user against the resource owner
Enable audit logging on managed hosts and alert on interactive shell sessions initiated by the Coolify service account outside change windows
Instrument the reverse proxy fronting Coolify to log WebSocket upgrades and the associated authenticated user identifier

Monitoring Recommendations

Alert on any 200-status response from terminal.auth where the authenticated user is not a member of the team owning the target resource
Monitor for new or unusual outbound processes spawned by container runtimes managed by Coolify
Track version strings reported by the Coolify instance and alert if any deployment reports a version below 4.0.0-beta.471

How to Mitigate CVE-2026-34047

Immediate Actions Required

Upgrade all Coolify instances to version 4.0.0-beta.471 or later without delay
Rotate credentials, SSH keys, and API tokens managed through Coolify if the instance was multi-tenant or exposed to untrusted authenticated users
Audit terminal session history and command logs on all managed servers for unauthorized activity predating the upgrade
Restrict Coolify account creation and review the roster of authenticated users on the instance

Patch Information

The fix ships in Coolify 4.0.0-beta.471. The commit bc91b41f92f1bbb53886a5d7a60335cbf1621cd5 applies the can.access.terminal middleware to the terminal bootstrap routes. See the GitHub Security Advisory GHSA-652w-qv22-2r7c, the Pull Request #9169, and the v4.0.0-beta.471 release notes for full details.

Workarounds

Place Coolify behind a reverse proxy that restricts access to /terminal/* routes by source IP or SSO group until the upgrade is applied
Disable or remove non-administrative user accounts on shared instances until patching is complete
Isolate Coolify-managed hosts on a dedicated network segment to limit blast radius from unauthorized terminal sessions

bash

# Example: block terminal routes at an nginx reverse proxy until patched
location ~ ^/terminal/ {
    allow 10.0.0.0/24;   # admin management network
    deny all;
    proxy_pass http://coolify_upstream;
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "upgrade";
}