CVE-2026-34594: Coolify Command Injection RCE Vulnerability

CVE-2026-34594 Overview

Coolify is an open-source, self-hostable platform for managing servers, applications, and databases. CVE-2026-34594 is an authenticated command injection vulnerability in the Destination Network Management functionality. The network parameter is passed directly to shell commands without sanitization. Any user with destination management permissions can execute arbitrary commands as root on managed servers, resulting in full remote code execution on the host. The issue is fixed in version 4.0.0-beta.471.

Critical Impact
An authenticated attacker with destination management permissions can achieve root-level remote code execution on any Coolify-managed server through unsanitized shell argument injection.

Affected Products

Coolify versions prior to 4.0.0-beta.471
Self-hosted Coolify deployments exposing the Destination Network Management functionality
Any downstream servers managed by a vulnerable Coolify instance

Discovery Timeline

2026-06-29 - CVE-2026-34594 published to NVD
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-34594

Vulnerability Analysis

The vulnerability is classified as OS Command Injection [CWE-78]. Coolify's Destination Network Management feature accepts a network parameter from authenticated users and forwards that value into a shell command invocation. Because the input is concatenated into a shell string rather than passed as a discrete argument to a safe execution API, an attacker can inject shell metacharacters such as ;, |, &&, or backticks. The injected commands execute in the context of the Coolify management process, which operates with root privileges on the managed servers it controls. This grants the attacker complete control over the host, including access to secrets, container runtimes, databases, and other tenant workloads managed by the same Coolify instance.

Root Cause

The root cause is missing input validation and unsafe shell command construction. The network parameter is interpolated directly into a shell string used to configure Docker or system networking on the target server. No allowlist, escaping, or argument-array based invocation is applied before the command is executed.

Attack Vector

Exploitation requires network access to the Coolify web interface and an authenticated account with destination management permissions. The attacker submits a crafted network value containing shell metacharacters through the Destination Network Management workflow. Coolify then dispatches the malicious command to a managed server, where it runs as root. No user interaction is required after submission.

No verified proof-of-concept code is publicly available. Refer to the GitHub Security Advisory GHSA-mf8p-rj62-9f9m for vendor technical detail.

Detection Methods for CVE-2026-34594

Indicators of Compromise

Unexpected child processes spawned by the Coolify management process or Docker daemon on managed hosts, particularly shells such as /bin/sh -c invoking network administration commands with unusual arguments.
Coolify audit or application logs showing Destination Network Management requests whose network field contains shell metacharacters (;, |, &, `, $().
New cron jobs, SSH authorized keys, or systemd units created on managed servers shortly after network destination modifications.

Detection Strategies

Monitor authenticated Coolify API and UI actions targeting destination or network endpoints and alert on payloads that include shell metacharacters in the network parameter.
Correlate Coolify request logs with process execution telemetry on managed servers to identify commands whose arguments originate from user-controlled network fields.
Baseline the set of processes normally spawned by Coolify orchestration and flag deviations, especially outbound network utilities such as curl, wget, or nc launched under the Coolify service account.

Monitoring Recommendations

Enable verbose audit logging for all destination and server management actions in Coolify and forward the logs to a centralized SIEM.
Collect execve telemetry on managed Linux hosts using auditd or eBPF-based sensors to reconstruct command chains initiated by Coolify.
Alert on any privileged shell activity that immediately follows Destination Network Management API calls.

How to Mitigate CVE-2026-34594

Immediate Actions Required

Upgrade all Coolify instances to version 4.0.0-beta.471 or later without delay.
Restrict destination management permissions to a minimal set of trusted administrator accounts and revoke unnecessary role assignments.
Rotate credentials, SSH keys, and API tokens stored on Coolify-managed servers if compromise is suspected.
Review Coolify audit logs for anomalous network parameter values submitted before the upgrade.

Patch Information

The vulnerability is fixed in Coolify 4.0.0-beta.471. The vendor advisory is available at the GitHub Security Advisory GHSA-mf8p-rj62-9f9m. Administrators should follow the standard Coolify update procedure and validate that the running version reports 4.0.0-beta.471 or higher after upgrade.

Workarounds

Place the Coolify web interface behind an authenticated reverse proxy or VPN to limit exposure to trusted operators only.
Disable or avoid using the Destination Network Management functionality until the patched version is deployed.
Enforce strict role-based access control and require multi-factor authentication for accounts with destination management privileges.

bash

# Verify installed Coolify version after upgrade
docker exec coolify sh -c 'cat /app/versions.json' | grep -i version

# Example: list users with destination management roles for review
# (adjust to your Coolify database/schema)
psql -U coolify -d coolify -c "SELECT id, email, role FROM users WHERE role IN ('admin','owner');"