CVE-2026-34038 — Coolify: authenticated command injection to RCE and secrets exfiltration (CVSS 9.9)
Coolify — a widely used open-source self-hosted PaaS / deployment platform (a Heroku/Vercel alternative for organizations running their own CI/CD-to-production pipelines) — fixed a CWE-78 OS command-injection flaw (CVSS 3.1 9.9, AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) in ApplicationDeploymentJob.php. The dockerfile_location and pre_deployment_command deployment parameters are passed to a shell without escaping, letting a user with only application "write" permission inject arbitrary OS commands (via ;, &&, backticks) that execute on the underlying host during a deployment; because deployment logs capture command output, exploitation also exfiltrates the application's configured environment secrets (coollabsio GHSA-qqrq-r9h4-x6wp, 2026-07-02). The vendor advisory notes a separate permission-bypass means the attacker does not need explicit "deploy" rights — broad "write" access is enough. BSI CERT-Bund published WID-SEC-2026-2182 the same day citing the GHSA as origin (BSI CERT-Bund, 2026-07-01). Fixed in ≥ v4.0.0-beta.469; ≤ v4.0.0-beta.462 are affected. No in-the-wild exploitation is reported by the vendor or BSI, and the CVE is not yet NVD-enriched. Detection: audit deployment-job logs for shell metacharacters in dockerfile_location/pre_deployment_command submitted by non-admin write-scoped accounts, and flag unexpected child processes off the PHP-FPM/queue-worker tree during a deployment (T1059 / T1190). Hardening: patch, restrict "write" grants to trusted users, and rotate any secrets referenced in deployment env vars that were reachable before patching.
An authenticated remote command injection vulnerability (CWE-78) in Coolify allows users with application 'write' permissions to achieve Remote Code Execution (RCE)
Defender actions
- If you self-host Coolify, patch to ≥ v4.0.0-beta.469 now and rotate any secrets referenced in deployment environment variables that were reachable before patching — the flaw exfiltrates them via deployment logs. Restrict application "write" grants to trusted users given the permission-bypass path.
ATT&CK mapping
2 techniques mapped from the cited reporting · MITRE ATT&CK v19.1
Initial Access TA0001
T1190Exploit Public-Facing Application
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.
Execution TA0002
T1059Command and Scripting Interpreter
Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell.
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.