Remote Code Injection in Coolify by Coollabs.io

CVE-2026-34152

What is CVE-2026-34152?

Coolify, a self-hostable management tool for servers and applications, suffers from a vulnerability in its command execution process. Prior to version 4.0.0-beta.471, commands executed during deployment were vulnerable to manipulation due to improper handling of single-quote escapes. This flaw allows authenticated attackers to inject arbitrary shell commands through SSH heredoc, potentially executing unintended actions on remote servers during application deployment. The vulnerability has been rectified in version 4.0.0-beta.471, emphasizing the importance of updating to this release.

References