Executive Summary
A critical authenticated remote command injection vulnerability (CVE-2026-34038) has been disclosed in Coolify, the popular open-source self-hostable PaaS platform used by tens of thousands of developers and small businesses as an alternative to Heroku and Vercel. The flaw carries a CVSS score of 9.9 and allows any user with write access on a Coolify instance to execute arbitrary OS commands on the underlying host and dump all environment variables — including API keys, database credentials, and secrets — directly through deployment logs.
CVSS Score: 9.9 (Critical)
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
The flaw is fixed in Coolify 4.0.0-beta.469. Administrators running any earlier version should update immediately and rotate all secrets stored in their Coolify deployments.
Vulnerability Overview
| Attribute | Value |
|---|---|
| CVE ID | CVE-2026-34038 |
| CWE | CWE-78 (Improper Neutralization of Special Elements in OS Commands) |
| CVSS Score | 9.9 (Critical) |
| Attack Vector | Network |
| Attack Complexity | Low |
| Privileges Required | Low (any authenticated user with write access) |
| User Interaction | None |
| Scope | Changed (C) — host-level impact from application context |
| GitHub Advisory | GHSA-qqrq-r9h4-x6wp |
Affected Versions
| Software | Affected Versions | Fixed Version |
|---|---|---|
| Coolify | All versions up to and including 4.0.0-beta.462 | 4.0.0-beta.469 |
Technical Details
The vulnerability exists in ApplicationDeploymentJob.php and arises from two user-controlled fields that are passed directly into Docker build commands without adequate shell escaping:
dockerfile_location— a user-supplied file path inserted into Docker build commands without sanitizationpre_deployment_command— a native shell command field with insufficient input validation
An attacker injects standard shell metacharacters (;, &&, backticks) to break out of the intended command boundaries. A minimal proof-of-concept payload:
; echo 'EXPLOIT_START'; env; echo 'EXPLOIT_END'; #
When placed in the pre_deployment_command field and a deployment is triggered, this chains arbitrary commands into the build pipeline. The output appears in deployment logs, which any user with read:sensitive permissions can access — resulting in full exfiltration of every environment variable loaded into the deployment context.
Attack Chain
1. Attacker authenticates to Coolify with any write-privilege account
2. Attacker sets dockerfile_location or pre_deployment_command to malicious payload
3. Attacker triggers a deployment (or waits for scheduled deployment)
4. Shell metacharacters break out of intended command scope
5. Injected commands execute with deployment process privileges on the host
6. env output (API keys, DB creds, secrets) captured in deployment logs
7. Attacker reads logs to harvest all environment variable valuesImpact
The S:C (Scope Changed) indicator in the CVSS vector is critical context here. A successful exploit breaks out of the application's security boundary and directly impacts the host system. In shared Coolify deployments where multiple teams or projects coexist, this is effectively a privilege escalation from low-privilege developer to host-level RCE.
| Impact Area | Description |
|---|---|
| Host RCE | Execute arbitrary OS commands with deployment process privileges |
| Secret Exfiltration | Dump all env vars — API keys, DB passwords, tokens, TLS keys |
| Lateral Movement | Pivot from compromised Coolify host to other networked systems |
| Persistence | Backdoors installable without malware flagging (process-based) |
| Data Breach | Access to all databases configured in Coolify deployments |
Remediation
Immediate Action: Update to 4.0.0-beta.469
# Via Coolify self-update (recommended)
curl -fsSL https://cdn.coollabs.io/coolify/install.sh | bash
# Check current version in Coolify dashboard:
# Settings > General > Coolify VersionThe patch in beta.469 implements:
- Strict input validation using allowlist regex (e.g.,
^[a-zA-Z0-9._\-/]+$) on path inputs escapeshellarg()wrapping on all user-supplied values inserted into shell commands- Path traversal blocking —
..sequences are rejected at the validation layer
If Immediate Update Is Not Possible
- Restrict Coolify write access — audit all user accounts; revoke write permissions from accounts that do not require deployment access
- Audit deployment logs for unexpected command output or environment variable dumps
- Rotate all secrets in Coolify environment variables as a precautionary measure
- Disable external-facing deployments until patching is complete if operating in a shared environment
Post-Patch Credential Rotation
Because this vulnerability could have been silently exploited before disclosure, rotate secrets even after patching:
# Identify all secrets stored in your Coolify environment variables
# Then rotate in order of criticality:
# 1. Database passwords
# 2. API keys (cloud providers, payment processors, third-party services)
# 3. OAuth secrets / JWT signing keys
# 4. TLS private keys if stored as env vars
# 5. Notification / webhook tokensDetection Indicators
| Indicator | Description |
|---|---|
Unexpected env output in deployment logs | Classic env-dump exfiltration payload executed |
| Shell metacharacters in deployment config fields | Attacker-controlled injection points |
| Deployment logs containing output from unexpected commands | Injected commands ran alongside build |
| Unusual outbound connections from the Coolify host | Post-exploitation data exfiltration |