CVE-2026-34597: Coolify Authenticated RCE Vulnerability

CVE-2026-34597 Overview

Coolify is an open-source, self-hostable platform for managing servers, applications, and databases. CVE-2026-34597 is an authenticated remote code execution (RCE) vulnerability in Coolify versions prior to 4.0.0-beta.470. The flaw exists in the handling of user-defined build parameters for the Nixpacks build pack. An authenticated attacker can inject shell metacharacters into the install_command build parameter, which is concatenated directly into a shell command executed on the deployment host. Successful exploitation allows arbitrary command execution with host-level privileges on the Coolify deployment host. The issue is fixed in version 4.0.0-beta.470.

Critical Impact
An authenticated attacker can execute arbitrary shell commands with host-level privileges on the Coolify deployment host, leading to full compromise of managed servers, applications, and databases.

Affected Products

Coolify versions prior to 4.0.0-beta.470
Deployments using the Nixpacks build pack
Self-hosted Coolify server management instances

Discovery Timeline

2026-06-29 - CVE-2026-34597 published to NVD
2026-06-30 - Last updated in NVD database

Technical Details for CVE-2026-34597

Vulnerability Analysis

CVE-2026-34597 is an OS command injection vulnerability [CWE-78] in the Coolify build orchestration logic. Coolify accepts user-defined build parameters when configuring a Nixpacks build. The install_command parameter is intended to specify how project dependencies are installed during the build phase. Instead of passing the value as an argument to a controlled process, Coolify concatenates it directly into a shell command string. The resulting string is then executed on the deployment host during the build phase. Because the shell interprets metacharacters such as ;, &&, |, and backticks, an attacker controlling install_command can break out of the intended build context.

Root Cause

The root cause is unsafe construction of a shell command from untrusted input. The install_command field is treated as trusted build metadata, but it originates from the authenticated user configuring the application. No sanitization, escaping, or argument-array execution is applied before invoking the shell. This pattern maps directly to CWE-78, Improper Neutralization of Special Elements used in an OS Command.

Attack Vector

Exploitation requires an authenticated Coolify user with permission to create or modify an application that uses the Nixpacks build pack. The attacker sets the install_command build parameter to a payload containing shell metacharacters and a secondary command. When Coolify triggers a build, the deployment host executes the injected command. The attacker gains code execution in the context of the Coolify build process, which typically has broad access to the host, container runtime, secrets, and other tenant workloads managed by the same instance.

No verified exploit code has been published. See the GitHub Security Advisory for vendor details.

Detection Methods for CVE-2026-34597

Indicators of Compromise

Unexpected child processes spawned by the Coolify build worker, such as sh, bash, curl, wget, or nc, that are not part of a normal Nixpacks build.
Nixpacks install_command values containing shell metacharacters like ;, &&, ||, |, $(, or backticks.
Outbound network connections from the Coolify host to unfamiliar destinations initiated during a build phase.
New or modified files under /tmp, /var/tmp, or user home directories created by the build process outside the project workspace.

Detection Strategies

Audit Coolify application configurations and inspect install_command, build_command, and other Nixpacks parameters for suspicious content.
Monitor process ancestry on Coolify hosts and alert on shell interpreters launched by the build worker with non-standard arguments.
Review Coolify application and deployment logs for build failures or unusual command output correlated with configuration changes.

Monitoring Recommendations

Enable endpoint telemetry on all Coolify deployment hosts to capture process creation, command lines, and network connections.
Forward Coolify audit logs and host process events to a centralized SIEM for correlation across builds and users.
Alert on any modification to build parameters by low-privilege or newly created Coolify accounts.

How to Mitigate CVE-2026-34597

Immediate Actions Required

Upgrade Coolify to version 4.0.0-beta.470 or later on all self-hosted instances.
Review all existing applications configured to use the Nixpacks build pack and inspect their build parameters for malicious content.
Rotate credentials, API tokens, and secrets stored in or accessible from Coolify if compromise is suspected.
Restrict Coolify user accounts to trusted operators and remove unused or shared accounts.

Patch Information

The vulnerability is fixed in Coolify 4.0.0-beta.470. Refer to the Coolify GHSA-9pp4-wcmj-rq73 advisory for release notes and remediation guidance.

Workarounds

If immediate upgrade is not possible, block untrusted users from creating or modifying applications that use the Nixpacks build pack.
Enforce mandatory review of build parameters before triggering deployments on shared Coolify instances.
Isolate the Coolify deployment host on a segmented network to limit lateral movement in the event of exploitation.

bash

# Configuration example: verify installed Coolify version meets the fixed release
docker exec -it coolify sh -c 'cat /var/www/html/config/version.php' \
  || curl -s http://localhost:8000/api/health

# Expected: Coolify version >= 4.0.0-beta.470