CVE-2026-34599 Details

A command injection vulnerability has been identified in the GetLogs Livewire component of Coolify, an open-source tool for managing servers, applications, and databases. This vulnerability, present in versions prior to 4.0.0-beta.471, allows authenticated users with team membership to execute arbitrary commands as root on managed servers. The issue arises because the $container Livewire public property is directly interpolated into shell commands without proper sanitization. Additionally, the property can be manipulated by clients via the Livewire wire protocol, as it lacks the #[Locked] attribute. The vulnerability is exacerbated by the absence of authorization checks in the getLogs() method, which fails to verify if the user has permission to access the targeted server or resource.

Users can update to Coolify version 4.0.0-beta.471 or later, where this vulnerability has been patched.