CVE-2026-34152 Details
Description
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, pre-deployment and post-deployment commands are single-quote escaped but then sent through SSH heredoc transport that preserves newlines, allowing an authenticated user to inject additional shell statements that execute on the remote server during deployment. This issue is fixed in version 4.0.0-beta.471.
A command injection vulnerability has been identified in Coolify versions prior to 4.0.0-beta.471. The issue arises in the application's deployment process, where pre-deployment and post-deployment commands are not properly sanitized before being executed on remote servers via SSH. This flaw allows authenticated users to inject additional shell commands that are executed during the deployment process. The vulnerability exists because newlines are preserved in the command payload, enabling the injection of arbitrary commands into the execution context.
Users can update to Coolify version 4.0.0-beta.471 or later, where this vulnerability has been fixed. Additionally, for future deployments, ensure that any commands set in the 'pre_deployment' or 'post_deployment' fields are sanitized to remove newline characters before execution.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 7, 2026CISA-ADP
Assessed Jul 9, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/coollabsio/coolify/commit/ad95d65aca064f49b38f73f88d61f842737d5463 | [email protected] | Source CodeVendor |
| https://github.com/coollabsio/coolify/pull/9173 | [email protected] | Issue TrackingVendor |
| https://github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.471 | [email protected] | Release NotesVendor |
| https://github.com/coollabsio/coolify/security/advisories/GHSA-5qp8-9gg7-4c86 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Coolify | <= 4.0.0-beta.470 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 9, 2026 | CVE Modified | CISA-ADP |
| Jul 7, 2026 | New CVE Received | [email protected] |