CVE-2026-34158: Coolify Command Injection RCE Vulnerability

CVE-2026-34158 Overview

Coolify is an open-source, self-hostable platform for managing servers, applications, and databases. Versions prior to 4.0.0-beta.469 contain a command injection vulnerability in the executeInDocker() helper function. The helper wraps user-controlled commands in single quotes without escaping embedded single quotes. Authenticated attackers who can edit application settings inject a single quote into docker_compose_custom_build_command or docker_compose_custom_start_command to break out of the quoted context. This allows arbitrary command execution on the managed server host during deployments, escaping the intended Docker container confinement. The issue is fixed in version 4.0.0-beta.469 and is tracked as [CWE-78].

Critical Impact
Authenticated attackers with application-edit permissions can execute arbitrary commands on the underlying host, breaking out of Docker isolation and fully compromising the Coolify-managed server.

Affected Products

Coolify versions prior to 4.0.0-beta.469
Self-hosted Coolify deployments managing Docker workloads
Any Coolify instance exposing application settings to lower-privileged users

Discovery Timeline

2026-07-07 - CVE-2026-34158 published to NVD
2026-07-07 - Last updated in NVD database

Technical Details for CVE-2026-34158

Vulnerability Analysis

The vulnerability resides in the executeInDocker() helper, which constructs shell commands by wrapping user-controlled strings in single quotes. Single quotes in POSIX shells suppress interpretation of most metacharacters but do not permit embedded single quotes. Coolify does not escape or reject single-quote characters inside the wrapped values. An attacker who supplies a value containing a ' character closes the quoted context prematurely and appends arbitrary shell syntax.

The attack surface is exposed through application configuration fields, specifically docker_compose_custom_build_command and docker_compose_custom_start_command. These fields are executed on the host during deployment operations, not inside the deployed container. As a result, successful injection yields code execution in the host context where the Coolify agent runs, defeating the container boundary.

The flaw maps to [CWE-78] Improper Neutralization of Special Elements used in an OS Command. Exploitation requires authenticated access with permission to modify application settings, but no user interaction is needed once the malicious value is saved and a deployment is triggered.

Root Cause

The root cause is unsafe shell-command assembly. The executeInDocker() helper relies on single-quote wrapping as its sole sanitization mechanism, ignoring the fact that single quotes cannot be embedded within a single-quoted string in POSIX shells. Proper mitigation requires either escaping embedded quotes, using an argument array without a shell interpreter, or strictly validating configuration input against an allow list.

Attack Vector

An authenticated user with edit rights on any Coolify application navigates to the custom Docker Compose command configuration and inserts a payload that closes the outer single quote, injects an arbitrary command, and reopens the quoted context. Triggering a deployment causes Coolify to run the crafted command on the host. The injected command executes with the privileges of the Coolify deployment process, providing access to Docker sockets, secrets, and other tenant applications on the same server. See the GitHub Security Advisory for technical details.

Detection Methods for CVE-2026-34158

Indicators of Compromise

Unexpected single-quote characters or shell metacharacters (;, &&, |, $() inside docker_compose_custom_build_command or docker_compose_custom_start_command values in the Coolify database.
Deployment logs containing shell errors such as unexpected EOF while looking for matching quote or unexplained command output during build or start phases.
Child processes spawned by the Coolify agent that do not correspond to docker, docker-compose, or expected build tooling.

Detection Strategies

Audit the Coolify application settings table for any custom command fields containing single quotes or shell control characters.
Monitor process execution on Coolify host servers for anomalous descendants of the Coolify PHP or worker process, especially shells (sh, bash) invoking network utilities.
Review deployment activity logs correlated with recent edits to application configuration by lower-privileged users.

Monitoring Recommendations

Enable command-line auditing (auditdexecve rules) on Coolify host servers and centralize logs for retrospective search.
Alert on outbound network connections initiated by the Coolify agent to non-registry destinations during deployment windows.
Track configuration changes to Coolify applications through database change auditing or filesystem integrity monitoring on the Coolify data volume.

How to Mitigate CVE-2026-34158

Immediate Actions Required

Upgrade Coolify to version 4.0.0-beta.469 or later without delay.
Restrict application-edit permissions to trusted administrators until the upgrade is complete.
Review all existing values of docker_compose_custom_build_command and docker_compose_custom_start_command for injection payloads and reset any suspicious entries.
Rotate any secrets, deployment tokens, or SSH keys stored on the Coolify host if unauthorized modification is suspected.

Patch Information

The vulnerability is fixed in Coolify 4.0.0-beta.469. The patch updates the executeInDocker() helper to properly handle single quotes in user-supplied command fields. Refer to the GitHub Security Advisory GHSA-j6j2-frv3-g6f7 for full remediation guidance.

Workarounds

Temporarily disable custom Docker Compose build and start command fields for non-administrative users.
Place the Coolify management interface behind an authenticated reverse proxy or VPN to reduce exposure of the edit surface.
Run Coolify workers under a dedicated, least-privileged system account with no access to host-level secrets where feasible.

bash

# Verify the installed Coolify version and upgrade if below 4.0.0-beta.469
docker exec coolify sh -c 'cat /var/www/html/config/version.php'

# Pull and restart with the patched release
cd /data/coolify/source
git fetch --tags
git checkout v4.0.0-beta.469
docker compose pull
docker compose up -d