Shell Command Injection Vulnerability in Coolify by Coollabs

CVE-2026-34034

What is CVE-2026-34034?

Coolify, an open-source tool for managing servers, applications, and databases, suffers from a shell command injection vulnerability. This issue arises from improper validation of the sentinel_token setting in shell commands, permitting an authenticated user access to alter Sentinel settings. If exploited, this could allow attackers to inject shell syntax and execute arbitrary commands on the host system upon a Sentinel restart. This vulnerability was resolved in version 4.0.0-beta.466, making it essential for users to upgrade to this or a later version to ensure system security. For further details, refer to the release note of version 4.0.0-beta.466.

References