Vulnerability · Published Jun 29, 2026 · Assigned by GitHub_M

CVE-2026-34594Coolify: Authenticated Remote Code Execution via Command Injection in Destination Network Management

High 8.8

In plain English

A high-severity OS command injection in coolify from coollabsio. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.4% (higher than 72% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)1.4%top 27.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, an authenticated command injection vulnerability in the Destination Network Management functionality allows users with destination management permissions to execute arbitrary commands as root on managed servers. The "network" parameter is passed directly to shell commands without proper sanitization, enabling full remote code execution on the host system. This vulnerability is fixed in 4.0.0-beta.471.

Affected products (as reported)

Vendor	Product	Versions
coollabsio	coolify	< 4.0.0-beta.471

Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

https://github.com/coollabsio/coolify/security/advisories/GHSA-mf8p-rj62-9f9m x_refsource_CONFIRM