Unauthorized Resource Cloning in Coolify by Coollabs

CVE-2026-34037

What is CVE-2026-34037?

Coolify, an open-source tool for managing servers, applications, and databases, contains a flaw prior to version 4.0.0-beta.464 in its cloneTo() Livewire action within ResourceOperations.php. This vulnerability permits authenticated users to clone resources into destinations controlled by other teams due to the use of unscoped Eloquent lookups for destination resource resolution. As a result, it allows unauthorized access to cross-tenant resources, compromising the security of separated environments.

References