CVE-2026-34035

HighCVSS 8.8/10Last modified Oct 25, 2026

Description

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.466, log drain secret and environment values were interpolated into shell commands without sufficient encoding, allowing an authenticated user to inject commands executed on the host. This issue is fixed in version 4.0.0-beta.466.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

Vendor	Product	Versions
coollabsio	coolify	< 4.0.0-beta.466

References

Timeline

Published: Jul 7, 2026
Last modified: Oct 25, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-340366.5Dolibarr is an enterprise resource planning (ERP) and customer relationship management (CRM) software package. In versions 22.0.4 and prior,CVE-2026-340379.9Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.464, the cloneTo() L CVE-2026-340389.9Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.469, an authenticate CVE-2026-34048.1A flaw has been found in thinkgem JeeSite up to 5.15.1. Impacted is an unknown function of the file /com/jeesite/common/shiro/cas/CasOutHand CVE-2026-340407.8Moby is an open source container framework. Prior to version 29.3.1, a security vulnerability has been detected that allows attackers to byp CVE-2026-340419.8act is a project which allows for local running of github actions. Prior to version 0.2.86, act unconditionally processes the deprecated ::s CVE-2026-340428.2act is a project which allows for local running of github actions. Prior to version 0.2.86, act's built in actions/cache server listens to c CVE-2026-340437.5Serialize JavaScript to a superset of JSON that includes regular expressions and functions. Prior to version 7.0.5, there is a Denial of Ser CVE-2026-340447.7Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.466, the Logs::mount CVE-2026-340459.1Podman Desktop is a graphical tool for developing on containers and Kubernetes. Prior to 1.26.2, an unauthenticated HTTP server exposed by P CVE-2026-340468.8Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.5.1, the `_read_flow` helper in `src/backe CVE-2026-340479.9Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, terminal WebSoc