CVE-2026-34158 coollabsio CVE debrief

Who should care

Users of Coolify versions prior to 4.0.0-beta.469 should be aware of this vulnerability and take steps to mitigate it. This includes reviewing their deployments, restricting access to application settings, and monitoring for suspicious activity. Operators, platform administrators, vulnerability management teams, and security teams should review the vulnerability details and assess their exposure.

Technical summary

The executeInDocker() helper function in Coolify wraps user-controlled commands in single quotes without properly escaping embedded single quotes. This allows attackers with the ability to edit application settings to inject a single quote into docker_compose_custom_build_command or docker_compose_custom_start_command, breaking out of the quoted context and executing arbitrary commands on the managed server host during deployments. The vulnerability is fixed in version 4.0.0-beta.469.

Defensive priority

High

Recommended defensive actions

• Upgrade to version 4.0.0-beta.469 or later
• Restrict access to application settings
• Monitor for suspicious activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

Evidence is limited; verification of vulnerability details and affected scope is needed. The executeInDocker() helper function in Coolify wraps user-controlled commands in single quotes without properly escaping embedded single quotes. This allows attackers with the ability to edit application settings to inject a single quote into docker_compose_custom_build_command or docker_compose_custom_start_command, breaking out of the quoted context and executing arbitrary commands on the managed server host during deployments. Limited evidence suggests that Coolify versions prior to 4.0.0-beta.469 are affected. Further verification is required to confirm the extent of the vulnerability and potential impact.

Official resources