Command Injection Vulnerability in Coolify by Coollabsio

CVE-2026-34035

What is CVE-2026-34035?

Coolify, an open-source server management tool, has a command injection vulnerability due to insufficient encoding of log drain secret and environment values in shell commands. This flaw allows authenticated users to potentially execute arbitrary commands on the host system, posing a significant security risk. The issue has been addressed in version 4.0.0-beta.466, which includes necessary protections against such injection attacks.

References