Skip to content
OpenAdvisories
High WID-SEC-2026-2192 34 CVEs

Coolify: Mehrere Schwachstellen

Published Jul 2, 2026 · Updated Jul 9, 2026 · Revision 3 · de-DE

Platform: Linux

Summary

Ein Angreifer kann mehrere Schwachstellen in Coolify ausnutzen, um beliebigen Programmcode auszuführen, um seine Privilegien zu erhöhen, um Informationen offenzulegen, um falsche Informationen darzustellen, um Dateien zu manipulieren, um einen Denial of Service Angriff durchzuführen, und um Sicherheitsvorkehrungen zu umgehen.

Product

Coolify ist eine Open-Source-Plattform zur Vereinfachung der Bereitstellung und Verwaltung von Anwendungen.

Vulnerabilities 34

  • Critical 10.0
    CVE-2025-66209 Public exploit

    Coolify Vulnerable to Authenticated Remote Code Execution via Command Injection in Database Backup

    Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.451, an authenticated command injection vulnerability in the Database Backup functionality allows users with application/service ma…

    coollabsio coolify
  • Critical 9.9
    CVE-2026-34037

    Cross-Tenant Resource Cloning via Broken Object-Level Authorization in cloneTo()

    Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.464, the cloneTo() Livewire action in ResourceOperations.php authorizes the source resource but resolves destination resources with unscope…

    coollabsio coolify
  • Critical 9.9
    CVE-2026-34047

    Coolify: WebSocket Endpoint Access Control Flaw Leading to Remote Code Execution

    Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, terminal WebSocket bootstrap routes did not enforce the expected authorization middleware, allowing an authenticated user to access te…

    coollabsio coolify
  • Critical 9.9
    CVE-2026-34048 Public exploit

    Coolify: Missing authorization on terminal websocket bootstrap routes allows low-privileged members to execute commands on team servers

    Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, terminal websocket bootstrap routes only check authentication and do not enforce terminal authorization, allowing a low-privileged tea…

    coollabsio coolify
  • Critical 9.4
    CVE-2025-66213

    Coolify Vulnerable to Authenticated Remote Code Execution via Command Injection in File Storage Directory Mount Path

    Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.451, an authenticated command injection vulnerability in the File Storage Directory Mount Path functionality allows users with appl…

    coollabsio coolify
  • High 8.8
    CVE-2026-34034

    Coolify: Host RCE via Sentinel token injection

    Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.466, the sentinel_token setting is used in shell commands without sufficient validation, allowing an authenticated user with access to serv…

    coollabsio coolify
  • High 8.8
    CVE-2026-34035

    Coolify: Host RCE via Log Drain secret/env command injection

    Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.466, log drain secret and environment values were interpolated into shell commands without sufficient encoding, allowing an authenticated u…

    coollabsio coolify
  • High 8.8
    CVE-2026-34057

    Coolify: Authenticated Remote Code Execution via Command Injection in Database Import Container Name

    Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, the database import Livewire component (app/Livewire/Project/Database/Import.php) allows client-controlled container and server proper…

    coollabsio coolify
  • High 8.8
    CVE-2026-34058

    Coolify: OS Command Injection via Unmanaged Container Operations - Remote Code Execution

    Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, the Livewire component Server\Resources exposes public methods (startUnmanaged, stopUnmanaged, restartUnmanaged) that accept a contain…

    coollabsio coolify
  • High 8.8
    CVE-2026-34152

    Coolify: Command Injection via Newline in Pre/Post Deployment Commands (Heredoc Transport)

    Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, pre-deployment and post-deployment commands are single-quote escaped but then sent through SSH heredoc transport that preserves newlin…

    coollabsio coolify
  • High 8.8
    CVE-2026-34153

    Coolify LocalFileVolume fs_path command injection enables RCE

    Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, LocalFileVolume::saveStorageOnServer builds shell commands using unescaped fs_path and parent_dir values before validation, and submit…

    coollabsio coolify
  • High 8.8
    CVE-2026-34158

    Coolify: Command injection via single-quote breakout in Docker Compose custom commands

    Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.469, the executeInDocker() helper wraps user-controlled commands in single quotes without escaping embedded single quotes. Attackers who ca…

    coollabsio coolify
  • High 8.8
    CVE-2026-34168

    Coolify: Command injection via unsanitized persistent storage name in docker volume commands

    Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, the LocalPersistentVolume.name field is interpolated directly into docker volume shell commands without shell argument escaping, allow…

    coollabsio coolify
  • High 8.8
    CVE-2026-34599

    Coolify: Authenticated Remote Code Execution in GetLogs Livewire Component

    Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, there is an authenticated command injection vulnerability in the GetLogs Livewire component which allows users with team membership (l…

    coollabsio coolify
  • High 8.8
    CVE-2026-42143

    Coolify: OS Command Injection via Persistent Volume Names - Root RCE on Managed Servers

    Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, user-controlled persistent volume names are interpolated into shell commands executed on managed servers without escaping or validatio…

    coollabsio coolify
  • High 8.8
    CVE-2026-42153

    Coolify: PostgreSQL Healthcheck Command Injection Allows Root Code Execution in Container

    Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, PostgreSQL healthcheck command generation used attacker-controlled database settings (postgres_user and postgres_db) in shell-form com…

    coollabsio coolify
  • High 8.8
    CVE-2026-42200

    Coolify: PostgreSQL Init Script Path Traversal Leads to Arbitrary File Write and Root RCE

    Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, PostgreSQL initialization script (generate_init_scripts() method in app/Actions/Database/StartPostgresql.php) filename handling did no…

    coollabsio coolify
  • High 8.8
    CVE-2026-42204

    Coolify: Authenticated RCE via SHELL_SAFE_COMMAND_PATTERN regression → host root

    Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. From 4.0.0-beta.471 through 4.0.0-beta.473, a regression in SHELL_SAFE_COMMAND_PATTERN allowed ampersands in custom Docker Compose build, start, and pre/post-d…

    coollabsio coolify
  • High 8.8
    CVE-2026-59734 Public exploit

    Coolify: OS Command Injection in Health Check Configuration Allows Remote Code Execution

    Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.469, Coolify's app/Jobs/ApplicationDeploymentJob.php generate_healthcheck_commands() function directly interpolated the health_check_host, …

    coollabsio coolify
  • High 8.0
    CVE-2026-34171

    Coolify: Account takeover via CSRF-able GET endpoint that resets password to attacker-known value

    Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, the GET /invitations/{uuid} endpoint can perform a state-changing password reset using an attacker-known invitation UUID, allowing an …

    coollabsio coolify
  • High 7.7
    CVE-2026-34044

    Coolify: Cross-team IDOR in logs component (resource lookup not team-scoped)

    Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.466, the Logs::mount() component looks up resources by UUID without scoping the lookup to the current team, allowing an authenticated user …

    coollabsio coolify
  • Medium 6.5
    CVE-2026-32718

    Coolify read-scoped API tokens can perform state-changing validation operations

    Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.466, mutating API validation endpoints are guarded by read ability, allowing read-scoped API tokens to perform state-changing operations su…

    coollabsio coolify
  • Medium 6.5
    CVE-2026-34050

    Coolify Settings/Updates Livewire component missing instance administrator authorization

    Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, the Settings/Updates Livewire component does not check isInstanceAdmin in its mount method, allowing non-admin users to access the Upd…

    coollabsio coolify
  • Medium 6.5
    CVE-2026-41899

    Coolify unauthenticated feedback endpoint allows Discord webhook abuse

    Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, POST /api/feedback has no authentication, no rate limiting, and no input validation, allowing arbitrary content to be forwarded direct…

    coollabsio coolify
  • Medium 5.3
    CVE-2026-34198

    Coolify: Password reset link poisoning via X-Forwarded-Host header spoofing

    Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, the TrustProxies middleware trusts all proxies ($proxies = '*'), accepting X-Forwarded-Host from any source. The TrustHosts middleware…

    coollabsio coolify
  • Medium 5.0
    CVE-2026-34167

    Coolify: Cross-tenant activity log disclosure via unlocked Livewire property in ActivityMonitor

    Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, the ActivityMonitor Livewire component exposes a public $activityId property without Livewire's #[Locked] attribute. It loads activiti…

    coollabsio coolify
  • Medium 4.9
    CVE-2026-42147

    Coolify: SSRF via S3 Storage Endpoint in testConnection()

    Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, S3 storage endpoint validation only checks URL format and testConnection() sends a server-side request to the configured endpoint, all…

    coollabsio coolify
  • Medium 4.3
    CVE-2026-34170

    Coolify: Server-Side Request Forgery via attacker-controlled GitHub App API URL

    Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, the GithubApp api_url field is used as the base URL for server-side HTTP requests without allowlisting or private IP blocking, allowin…

    coollabsio coolify
  • Low 3.8
    CVE-2026-42148

    Coolify: Command Injection via Unescaped Version String in Docker Build

    Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, the buildHelperImage method in app/Livewire/Settings/Index.php constructs a Docker build command using the dev_helper_version field wi…

    coollabsio coolify
  • Low 3.3
    CVE-2026-34049

    Coolify: Command Injection via unsanitized MongoDB collection names in database backup

    Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. From 4.0.0-beta.451 through 4.0.0-beta.470, database backup handling for MongoDB collection names did not fully validate shell metacharacters, allowing a highl…

    coollabsio coolify
  • Low 3.3
    CVE-2026-34149

    Coolify: Authenticated Host-Level RCE via Unescaped Database Credentials in Backup Jobs

    Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, DatabaseBackupJob interpolates user-controlled database credentials and MongoDB collection exclusion names into backup shell commands …

    coollabsio coolify
  • Low 3.3
    CVE-2026-42201

    Coolify: OS Command Injection via Database Credential Fields in Docker Compose Service Commands

    Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, database credential fields (redis_password, keydb_password, dragonfly_password, clickhouse_admin_user, clickhouse_admin_password, post…

    coollabsio coolify
  • Low 3.1
    CVE-2026-42145

    Coolify: File Upload Without Type or Size Validation in Database Backup Restore

    Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, the file upload endpoint (app/Http/Controllers/UploadController.php) for database backup restore uploads did not enforce file type or …

    coollabsio coolify
  • Low 3.1
    CVE-2026-42172

    Coolify: Sanctum API Tokens Have No Expiration — Leaked Tokens Grant Permanent Access

    Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, Sanctum API tokens did not expire, allowing a leaked token to retain access indefinitely until manually revoked. This issue is fixed i…

    coollabsio coolify

Revision history

  1. #3

    Referenz(en) aufgenommen: CVE-2026-59734, EUVD-2026-42657

  2. #2

    CVE-Nummern ergänzt

  3. #1

    Initiale Fassung

References