PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-34057 coollabsio CVE debrief

CVE-2026-34057 is a high-severity vulnerability in Coolify, an open-source tool for managing servers, applications, and databases. The vulnerability exists in the database import Livewire component, where client-controlled container and server properties can reach shell commands without proper locking or validation. This allows an authenticated user to inject commands through a database import container name. The issue was fixed in version 4.0.0-beta.471. Administrators and users of Coolify should be aware of this vulnerability and take immediate action to update to the patched version.

Vendor
coollabsio
Product
coolify
CVSS
HIGH 8.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-07
Original CVE updated
2026-07-07
Advisory published
2026-07-07
Advisory updated
2026-07-07

Who should care

Administrators and users of Coolify, especially those with access to the database import feature, should be aware of this vulnerability and take immediate action to update to the patched version. This includes reviewing and restricting access to the database import feature, monitoring for suspicious activity related to database imports, and ensuring that Coolify version 4.0.0-beta.471 or later is deployed.

Technical summary

The vulnerability exists in the app/Livewire/Project/Database/Import.php file of Coolify, where user-controlled input is not properly sanitized, allowing for command injection through a database import container name. This issue allows an authenticated user to inject commands. The CVSS score for this vulnerability is 8.8, indicating a high severity. The vulnerability was fixed in version 4.0.0-beta.471.

Defensive priority

High priority should be given to updating Coolify to version 4.0.0-beta.471 or later, as well as reviewing and restricting access to the database import feature.

Recommended defensive actions

  • Update Coolify to version 4.0.0-beta.471 or later
  • Review and restrict access to the database import feature
  • Monitor for suspicious activity related to database imports
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
  • Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
  • Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record was published on 2026-07-07T04:17:48.647Z and last modified on 2026-07-07T14:16:30.080Z. The NVD entry is currently Deferred. Evidence is limited to public CVE and NVD information. Defenders should verify Coolify version 4.0.0-beta.471 or later is deployed, review database import feature access, and monitor for suspicious activity.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-34057 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-34057

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-34057 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-34057

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.