CVE-2026-34058: Coolify Command Injection RCE Vulnerability

CVE-2026-34058 Overview

Coolify is an open-source, self-hostable platform for managing servers, applications, and databases. CVE-2026-34058 is an OS command injection vulnerability [CWE-78] affecting Coolify versions prior to 4.0.0-beta.471. The Livewire component Server\Resources exposes three public methods, startUnmanaged, stopUnmanaged, and restartUnmanaged, that accept a container ID directly from the browser without sanitization. The parameter is interpolated into shell commands executed over SSH on managed servers. Any authenticated team member can execute arbitrary operating system commands on remote hosts controlled by Coolify.

Critical Impact
Authenticated attackers can execute arbitrary OS commands over SSH on any Coolify-managed server, resulting in full compromise of downstream infrastructure.

Affected Products

Coolify versions prior to 4.0.0-beta.471
Coolify Livewire component App\Livewire\Server\Resources
Any downstream server managed by a vulnerable Coolify instance

Discovery Timeline

2026-07-07 - CVE-2026-34058 published to NVD
2026-07-07 - Last updated in NVD database

Technical Details for CVE-2026-34058

Vulnerability Analysis

Coolify uses the Laravel Livewire framework to expose interactive server-management actions to authenticated users. The Server\Resources component defines three public methods, startUnmanaged($containerId), stopUnmanaged($containerId), and restartUnmanaged($containerId). Livewire allows any authenticated user in the browser session to invoke these public component methods directly, passing arbitrary arguments.

The methods forward the supplied container identifier into a shell command that Coolify then executes over SSH on the target managed server. Because the container ID is neither validated against an allowlist nor shell-escaped, attackers can append shell metacharacters such as ;, &&, |, or command substitution sequences. The injected payload executes with the privileges of the SSH user that Coolify uses to manage the remote host, which is typically root or a highly privileged automation account.

The issue is classified under [CWE-78] Improper Neutralization of Special Elements used in an OS Command. Exploitation requires only a low-privileged authenticated team account and does not require user interaction.

Root Cause

The root cause is missing input validation on Livewire component parameters that flow into shell command construction. The vulnerable code path trusted the client-supplied container ID as an opaque string and used string interpolation rather than argument arrays or explicit escaping when constructing the remote SSH command.

Attack Vector

An attacker with any authenticated Coolify team membership sends a Livewire message from a browser session that invokes startUnmanaged, stopUnmanaged, or restartUnmanaged with a crafted container ID containing shell metacharacters. Coolify establishes its normal SSH channel to the managed server and executes the interpolated command, running the attacker payload on the remote host.

php

// Security patch in app/Livewire/Server/Resources.php
 namespace App\Livewire\Server;
 
 use App\Models\Server;
+use App\Support\ValidationPatterns;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Livewire\Component;

The patch introduces App\Support\ValidationPatterns into the Server\Resources Livewire component so that container identifiers are validated before being passed to the SSH executor. Source: GitHub Commit 944a038.

Detection Methods for CVE-2026-34058

Indicators of Compromise

Coolify application logs showing invocations of startUnmanaged, stopUnmanaged, or restartUnmanaged with container ID values containing shell metacharacters such as ;, |, &, $(, or backticks.
SSH session activity from the Coolify host to managed servers executing unexpected commands outside of container lifecycle operations.
New or modified files, cron entries, or user accounts on managed servers appearing shortly after Livewire requests to the Server\Resources component.

Detection Strategies

Inspect web server and Laravel logs for Livewire updateSync or callMethod requests targeting Server.Resources with anomalous containerId parameters.
Correlate Coolify audit events for unmanaged container actions with subsequent process creation events on downstream managed servers.
Alert on shell metacharacters in any parameter that is expected to be a Docker container ID, which by specification is a hexadecimal string.

Monitoring Recommendations

Enable verbose SSH session logging on managed servers and ship command history to a central log store for analysis.
Monitor outbound SSH activity from Coolify hosts for command patterns inconsistent with docker start, docker stop, or docker restart.
Track Coolify version strings across your fleet to identify instances still running builds earlier than 4.0.0-beta.471.

How to Mitigate CVE-2026-34058

Immediate Actions Required

Upgrade all Coolify instances to version 4.0.0-beta.471 or later without delay.
Audit Coolify team membership and revoke access for accounts that do not require server management privileges.
Rotate SSH keys and any secrets that were reachable from Coolify-managed servers if exploitation is suspected.
Review managed servers for unauthorized processes, persistence mechanisms, and modified system binaries.

Patch Information

The vulnerability is fixed in Coolify 4.0.0-beta.471. The remediation adds input validation on container identifiers passed to startUnmanaged, stopUnmanaged, and restartUnmanaged in the Server\Resources Livewire component. See the GitHub Security Advisory GHSA-rh5x-qx77-fq9v, the pull request #9172, and the v4.0.0-beta.471 release notes.

Workarounds

Restrict network access to the Coolify web interface to trusted administrators using a VPN or IP allowlist until the patch is applied.
Limit Coolify team membership to a minimal set of trusted users, since exploitation requires authenticated access.
Isolate the Coolify SSH management account with least-privilege sudo rules and disable interactive shells where possible.

bash

# Verify the running Coolify version and upgrade
docker exec coolify sh -c 'cat /var/www/html/versions.json' | grep version

# Pull the fixed release
curl -fsSL https://cdn.coollabs.io/coolify/install.sh | bash -s -- --version 4.0.0-beta.471