CVE-2026-34034 coollabsio CVE debrief

Who should care

Users of Coolify versions prior to 4.0.0-beta.466 should review and update their installations to mitigate this vulnerability. This includes operators, platform administrators, vulnerability management teams, and security teams who need to assess the impact of this vulnerability on their systems and plan for remediation.

Technical summary

The Coolify tool, used for managing servers, applications, and databases, had a vulnerability prior to version 4.0.0-beta.466. An authenticated user with access to server Sentinel settings could inject shell syntax and execute commands on the host when Sentinel is restarted due to insufficient validation of the sentinel_token setting in shell commands. This vulnerability has a CVSS score of 8.8 and is considered high severity.

Defensive priority

High priority due to CVSS score of 8.8 and potential for command execution.

Recommended defensive actions

• Update Coolify to version 4.0.0-beta.466 or later
• Review and restrict access to server Sentinel settings
• Monitor for suspicious activity related to Sentinel restarts
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

Evidence from the NVD and CVE records indicate a high severity vulnerability in Coolify, with limited details on exploitability and affected systems. The vulnerability allows an authenticated user with access to server Sentinel settings to inject shell syntax and execute commands on the host when Sentinel is restarted. Further verification is needed to confirm affected scope and exposure.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.