CVE-2026-34047 coollabsio CVE debrief

Who should care

Users of Coolify versions prior to 4.0.0-beta.471 should update to the latest version to prevent unauthorized access to terminal functionality. This includes operators managing servers, applications, and databases with Coolify, as well as platform administrators and security teams responsible for vulnerability management and ensuring the security of their environments.

Technical summary

The vulnerability exists in the terminal WebSocket bootstrap routes of Coolify, an open-source tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.471, these routes did not properly enforce authorization middleware. This allowed authenticated users to access terminal functionality for resources outside their authorized scope and potentially execute commands. The issue was addressed in version 4.0.0-beta.471. The vulnerability has a CVSS score of 9.9, indicating a high severity level. Affected product deployments should be reviewed to confirm their exposure, and compensating controls should be considered while remediation is scheduled and verified.

Defensive priority

High, given the CVSS score of 9.9 and potential for command execution. Users should prioritize updating to version 4.0.0-beta.471 or later and review access to terminal functionality. Monitoring for suspicious activity is also recommended, as the vulnerability allows authenticated users to access resources outside their authorized scope. Compensating controls, such as restricting access to terminal functionality, should be considered while remediation is scheduled and verified. Additionally, tracking exceptions and retesting remediated assets are crucial steps in ensuring the vulnerability is properly addressed. The Coolify development team has addressed the issue, and users should leverage this fix to enhance their security posture. To further verify the vulnerability's impact, defenders should review the official CVE record and assess their specific deployment contexts. This includes confirming whether affected product deployments exist in managed environments and assigning an owner for follow-up. By taking these steps, organizations can better protect themselves against potential exploitation of CVE-2026-34047. The vulnerability's critical nature and potential for significant impact underscore the importance of prompt action and thorough verification of remediation efforts. Therefore, a comprehensive review of the affected systems, coupled with the implementation of compensating controls and continuous monitoring, is essential to mitigate the risks associated with CVE-2026-34047 effectively. Given these factors, the defensive priority remains high, necessitating immediate attention and thorough remediation strategies to prevent potential exploitation and minimize operational impact. To achieve this, organizations should focus on updating to the latest version, reviewing and restricting access, and enhancing monitoring capabilities to detect any suspicious activity related to the vulnerability. By prioritizing these actions, organizations can effectively manage the risks associated with CVE-2026-34047 and improve their overall security posture. In addition to these measures, it is crucial to maintain a detailed inventory of affected assets and to track the rem

Recommended defensive actions

• Update Coolify to version 4.0.0-beta.471 or later
• Review and restrict access to terminal functionality
• Monitor for suspicious activity
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

Evidence from the NVD and GitHub indicates that the vulnerability was fixed in version 4.0.0-beta.471. Users should update to this version or later to prevent exploitation. The vulnerability allows an authenticated user to access terminal functionality for resources outside the authorized scope and potentially execute commands. This issue is critical, with a CVSS score of 9.9, and users of Coolify versions prior to 4.0.0-beta.471 are affected.

Official resources