CVE-2026-34058 coollabsio CVE debrief

Who should care

Users of Coolify versions prior to 4.0.0-beta.471 should apply the patch immediately. This includes administrators and team members with access to the affected systems. Additionally, security teams and vulnerability management teams should review the vulnerability and implement compensating controls for exposed systems while remediation is scheduled and verified.

Technical summary

The Livewire component Server Resources in Coolify exposes public methods (startUnmanaged, stopUnmanaged, restartUnmanaged) that accept a container ID parameter directly from the browser without sanitization or escaping. This parameter is interpolated into shell commands executed via SSH on managed servers, enabling authenticated team members to execute arbitrary OS commands on remote servers. The vulnerability affects Coolify versions prior to 4.0.0-beta.471 and has been fixed in version 4.0.0-beta.471 or later. The issue has a high CVSS score of 8.8 and is classified as HIGH severity.

Defensive priority

High priority due to the potential for arbitrary OS command execution on remote servers. Defenders should prioritize patching or mitigating this vulnerability to prevent potential attacks. Implement additional security controls, such as input validation and SSH hardening, to reduce the attack surface. Monitor for suspicious activity on managed servers and review access to the Livewire component Server Resources. Consider restricting access to the affected systems and implementing compensating controls for exposed systems while remediation is scheduled and verified. Track exceptions, retest remediated assets, and close the item only after evidence is documented. Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed. Check relevant monitoring, detection, and logs for exposed assets that need extra review. Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up. This vulnerability has a high CVSS score of 8.8 and is classified as HIGH severity. Users of Coolify should apply the patch immediately to prevent potential attacks. This includes administrators and team members with access to the affected systems. The CVE record was published on 2026-07-07T04:17:49.193Z and last modified on 2026-07-07T14:16:30.180Z. The NVD entry is currently Deferred. Evidence is limited to public sources and may not reflect the full scope or impact of the vulnerability. Defenders should verify affected systems and apply patches or mitigations as needed. The Livewire component Server Resources in Coolify exposes public methods (startUnmanaged, stopUnmanaged, restartUnmanaged) that accept a container ID parameter directly from the browser without sanitization or escaping. This parameter is interpolated into shell commands executed via SSH on managed servers, enabling authenticated team members to execute arbitrary OS commands on remote servers. Users of Coolify versions prior to 4.0.0-beta.471 should apply the patch immediately. This includes administrators and team members with

Recommended defensive actions

• Apply the patch by upgrading to Coolify version 4.0.0-beta.471 or later.
• Review and restrict access to the Livewire component Server Resources.
• Monitor for suspicious activity on managed servers.
• Implement additional security controls, such as input validation and SSH hardening.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Evidence notes

The CVE record was published on 2026-07-07T04:17:49.193Z and last modified on 2026-07-07T14:16:30.180Z. The NVD entry is currently Deferred. Evidence is limited to public sources and may not reflect the full scope or impact of the vulnerability. Defenders should verify affected systems and apply patches or mitigations as needed.

Official resources