CVE-2026-34594

8.8 Élevée

Publiée le 29/06/2026 à 23:16 · Modifiée le 01/07/2026 à 17:17 · Analyse NVD reportée · Source : security-advisories@github.com

Description

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, an authenticated command injection vulnerability in the Destination Network Management functionality allows users with destination management permissions to execute arbitrary commands as root on managed servers. The "network" parameter is passed directly to shell commands without proper sanitization, enabling full remote code execution on the host system. This vulnerability is fixed in 4.0.0-beta.471.

Traduire en français

Produits concernés

coollabsio coolify

Scores CVSS

Version	Score	Source	Vecteur
3.1	8.8 Élevée	security-advisories@github.com	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`

Faiblesses (CWE)

CWE-78

Références

https://github.com/coollabsio/coolify/security/advisories/GHSA-mf8p-rj62-9f9m
https://github.com/coollabsio/coolify/security/advisories/GHSA-mf8p-rj62-9f9m

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories