High severity8.8NVD Advisory· Published Jul 7, 2026· Updated Jul 7, 2026

CVE-2026-34035

Description

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.466, log drain secret and environment values were interpolated into shell commands without sufficient encoding, allowing an authenticated user to inject commands executed on the host. This issue is fixed in version 4.0.0-beta.466.

Affected products

Coollabsio/Coolifyllm-fuzzy
Range: <4.0.0-beta.466

Patches

Vulnerability mechanics

References

github.com/coollabsio/coolify/commit/fcd574e1eb1c2f504c48e5be4a5cb6d69f8f1f55nvd
github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.466nvd
github.com/coollabsio/coolify/security/advisories/GHSA-3xm2-hqg8-4m2pnvd

News mentions

No linked articles in our index yet.

cvss	0.572
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000