CVE-2026-59734

HighCVSS 8.8/10Last modified Oct 25, 2026

Description

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.469, Coolify's app/Jobs/ApplicationDeploymentJob.php generate_healthcheck_commands() function directly interpolated the health_check_host, health_check_method, and health_check_path parameters into shell commands without proper sanitization, allowing authenticated users to execute arbitrary commands inside deployment containers. This issue is fixed in version 4.0.0-beta.469.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

Vendor	Product	Versions
coollabsio	coolify	< 4.0.0-beta.469

References

Timeline

Published: Jul 9, 2026
Last modified: Oct 25, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-597397.5Information disclosure via SetWatches reconnect replay in Apache ZooKeeper due to missing ACL check. An attacker can discover ACL-restricted CVE-2026-59749.8A vulnerability was determined in FoundationAgents MetaGPT up to 0.8.1. The affected element is the function Bash.run in the library metagpt CVE-2026-59759.8A vulnerability was identified in Totolink A7100RU 7.4cu.2313_b20191024. The impacted element is the function setDmzCfg of the file /cgi-bin CVE-2026-59769.8A security flaw has been discovered in Totolink A7100RU 7.4cu.2313_b20191024. This affects the function setStorageCfg of the file /cgi-bin/c CVE-2026-597627.5When an HTTP/2 profile is configured on a virtual server, undisclosed requests can cause an increase in memory resource utilization. CVE-2026-597634.3Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads CVE-2026-597648.6ELECOM wireless LAN routers and access points devices contain an OS Command Injection vulnerability in WebUI. If this vulnerability is explo CVE-2026-597657.5SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata CVE-2026-597664.3Gitea's starred-repository and tracked-time API endpoints do not re-check current repository permissions before returning data associated wi CVE-2026-597699.1FA-50 all versions contain hard-coded credentials. An attacker, who knows the credentials and has access to the vessel's internal network, CVE-2026-59779.8A weakness has been identified in Totolink A7100RU 7.4cu.2313_b20191024. This impacts the function setWiFiBasicCfg of the file /cgi-bin/cste CVE-2026-597716.7Improper validation of array index in the MigTD's virtio-serial driver for the Intel(R) TDX Migration Trust Domain (MigTD) within Ring 0: Hy