CVE-2026-34057: Coolify Command Injection RCE Vulnerability

CVE-2026-34057 Overview

Coolify is an open-source, self-hostable platform for managing servers, applications, and databases. CVE-2026-34057 is a command injection vulnerability [CWE-78] in the database import Livewire component located at app/Livewire/Project/Database/Import.php. Client-controlled container and server properties reach shell commands without locking or validation. An authenticated user can inject operating system commands through a database import container name. The issue affects Coolify versions prior to 4.0.0-beta.471 and is fixed in that release.

Critical Impact
An authenticated Coolify user can achieve arbitrary command execution on the managed server by injecting shell metacharacters into a container name processed by the database import flow.

Affected Products

Coolify versions prior to 4.0.0-beta.471
app/Livewire/Project/Database/Import.php component
app/Livewire/Project/Shared/ExecuteContainerCommand.php component

Discovery Timeline

2026-07-07 - CVE-2026-34057 published to NVD
2026-07-07 - Last updated in NVD database
Fixed in release - v4.0.0-beta.471 published on GitHub

Technical Details for CVE-2026-34057

Vulnerability Analysis

The vulnerability resides in the Coolify database import workflow, implemented as a Livewire component in app/Livewire/Project/Database/Import.php. Livewire components synchronize public properties between the browser and the server. When properties are not marked with the #[Locked] attribute, an authenticated client can modify them prior to server-side actions being invoked.

In the vulnerable component, container and server properties tied to the import operation are sent to shell commands without server-side re-validation. Because the container name is concatenated into a shell invocation used to execute the database import inside the target container, injecting shell metacharacters allows arbitrary command execution in the context of the Coolify agent process. This maps directly to CWE-78, OS Command Injection.

Root Cause

Two defects combine to enable exploitation. First, Livewire public properties representing the target container and server are not locked, so a client can substitute attacker-controlled values instead of the values chosen by the UI. Second, the import command builder does not enforce a strict validation pattern on the container name before passing it to a shell command. The patch introduces a shared ValidationPatterns helper and marks sensitive properties with the #[Locked] attribute.

Attack Vector

Exploitation requires an authenticated Coolify account with access to a project that supports database imports. The attacker intercepts the Livewire update request, replaces the container name with a payload containing shell metacharacters (for example, appending ; <command> or command substitution), and triggers the import action. The injected command executes on the server that runs the target container.

php

// Patch excerpt: app/Livewire/Project/Database/Import.php
 use App\Models\S3Storage;
 use App\Models\Server;
 use App\Models\Service;
+use App\Support\ValidationPatterns;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Illuminate\Support\Facades\Auth;
 use Illuminate\Support\Facades\Storage;
 use Livewire\Attributes\Computed;
+use Livewire\Attributes\Locked;
 use Livewire\Component;

 class Import extends Component

Source: Coolify commit d486bf09

The patch adds Locked attributes to prevent client tampering with sensitive properties and consolidates container name validation through the new ValidationPatterns helper. The same fix pattern is applied in app/Livewire/Project/Shared/ExecuteContainerCommand.php.

Detection Methods for CVE-2026-34057

Indicators of Compromise

Unexpected child processes spawned by the Coolify PHP or agent process, such as sh, bash, curl, wget, or nc.
Container names or Livewire payloads in web server access logs containing shell metacharacters like ;, |, `, $(, or newline sequences.
Outbound network connections from the Coolify host to unknown hosts shortly after a database import request.
New or modified files under the Coolify installation directory or /tmp following an import operation.

Detection Strategies

Inspect HTTP request bodies to Livewire endpoints (/livewire/update) for container name fields containing non-alphanumeric characters beyond - and _.
Alert on process lineage where the PHP-FPM or Coolify worker process spawns interactive shells or network utilities.
Correlate authenticated user sessions with database import events and immediate command execution telemetry on the same host.

Monitoring Recommendations

Enable audit logging on the Coolify host for execve syscalls and forward events to a centralized log store for retention and search.
Monitor the Coolify installation for version drift and confirm all instances are at 4.0.0-beta.471 or later.
Review Coolify user accounts and remove stale or shared credentials that increase the pool of potential authenticated attackers.

How to Mitigate CVE-2026-34057

Immediate Actions Required

Upgrade every Coolify instance to version 4.0.0-beta.471 or later without delay.
Rotate any credentials, API tokens, or SSH keys stored on hosts running vulnerable Coolify versions, since command execution may have exposed them.
Restrict Coolify web interface access to trusted networks or place it behind a VPN and enforce multi-factor authentication for all users.
Review recent database import activity in Coolify logs for unusual container names or failed imports that may indicate probing.

Patch Information

The fix is delivered in Coolify v4.0.0-beta.471. The patch, introduced in commit d486bf09, applies Livewire #[Locked] attributes to container and server properties and centralizes container name validation through the new ValidationPatterns helper. Additional context is available in the GitHub Security Advisory GHSA-6r3g-w7x8-54fj and the v4.0.0-beta.471 release notes.

Workarounds

Disable database import functionality by revoking user roles that can trigger imports until the upgrade is complete.
Limit Coolify user accounts to trusted operators only, since exploitation requires authentication.
Isolate the Coolify management host on a dedicated network segment to contain the impact of any successful command injection.

bash

# Upgrade Coolify to the patched release
curl -fsSL https://cdn.coollabs.io/coolify/install.sh | bash

# Verify the running version is at or above the fixed release
docker inspect coolify --format '{{.Config.Image}}'
# Expected: coollabsio/coolify:4.0.0-beta.471 or later