PT-2026-53737 · Coolify · Coolify

Kritsana-Chaikaew

·

CVE-2026-34594

·

Published

2026-06-29

·

Updated

2026-06-30

CVSS v3.1

8.8

High

VectorAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Coolify versions prior to 4.0.0-beta.471
Description An authenticated command injection issue exists in the Destination Network Management functionality. Users with destination management permissions can execute arbitrary commands as root on managed servers because the network parameter is passed directly to shell commands without proper sanitization, leading to remote code execution on the host system.
Recommendations Update to version 4.0.0-beta.471.

Exploit

Fix

RCE

OS Command Injection

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2026-34594
GHSA-MF8P-RJ62-9F9M

Affected Products

Coolify