CVE-2026-34034

8.8 Élevée

Publiée le 07/07/2026 à 06:17 · Modifiée le 07/07/2026 à 15:22 · Analyse NVD reportée · Source : security-advisories@github.com

Description

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.466, the sentinel_token setting is used in shell commands without sufficient validation, allowing an authenticated user with access to server Sentinel settings to inject shell syntax and execute commands on the host when Sentinel is restarted. This issue is fixed in version 4.0.0-beta.466.

Traduire en français

Produits concernés

coollabsio coolify

Scores CVSS

Version	Score	Source	Vecteur
3.1	8.8 Élevée	security-advisories@github.com	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`

Faiblesses (CWE)

CWE-78

Références

https://github.com/coollabsio/coolify/commit/096d4369e59b3db7ace2db3ca42588c41b9b6019
https://github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.466
https://github.com/coollabsio/coolify/security/advisories/GHSA-rpr8-p7jc-x844
https://github.com/coollabsio/coolify/security/advisories/GHSA-rpr8-p7jc-x844

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories