Command Injection Vulnerability in Coolify - Open-Source Management Tool

CVE-2026-34594

What is CVE-2026-34594?

Coolify, an open-source tool designed for managing servers, applications, and databases, contains a command injection vulnerability that allows users with destination management permissions to execute arbitrary commands on managed servers. This issue arises from the improper handling of the 'network' parameter, which is directly passed to shell commands without appropriate sanitization. This lack of validation potentially allows attackers to perform full remote code execution on the affected systems. The vulnerability has been addressed in version 4.0.0-beta.471.

References