Vulnerability · Published Jul 7, 2026 · Assigned by GitHub_M

CVE-2026-34047Coolify: WebSocket Endpoint Access Control Flaw Leading to Remote Code Execution

Critical 9.9

In plain English

A critical-severity incorrect authorization in coolify from coollabsio. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 46% of all known vulnerabilities).

Severity (CVSS 3.1)9.9Critical

Exploit odds (30 days)0.6%top 53.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, terminal WebSocket bootstrap routes did not enforce the expected authorization middleware, allowing an authenticated user to access terminal functionality for resources outside the authorized scope and potentially execute commands. This issue is fixed in version 4.0.0-beta.471.

Affected products (as reported)

Vendor	Product	Versions
coollabsio	coolify	< 4.0.0-beta.471

Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

References

https://github.com/coollabsio/coolify/security/advisories/GHSA-652w-qv22-2r7c x_refsource_CONFIRM
https://github.com/coollabsio/coolify/pull/9169 x_refsource_MISC
https://github.com/coollabsio/coolify/commit/bc91b41f92f1bbb53886a5d7a60335cbf1621cd5 x_refsource_MISC
https://github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.471 x_refsource_MISC