CVE-2026-34038

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.469, an authenticated remote command injection vulnerability in application deployment handling allows users with application write permissions to achieve remote code execution and exfiltrate sensitive environment variables through deployment logs via fields such as dockerfile_location and deployment commands. This issue is fixed in version 4.0.0-beta.469.

• CWE-78

• https://github.com/coollabsio/coolify/commit/23f9156c7306b221101f1ebbe4d3c6b5e2522acd
• https://github.com/coollabsio/coolify/pull/9007
• https://github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.469
• https://github.com/coollabsio/coolify/security/advisories/GHSA-qqrq-r9h4-x6wp
• https://github.com/coollabsio/coolify/security/advisories/GHSA-qqrq-r9h4-x6wp

Published

Jul 6, 2026

Last Modified

Jul 7, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-34032Improper Null Termination, Out-of-bounds Read vulnerability …5.3
• CVE-2026-34033Improper Neutralization of Script-Related HTML Tags in a Web…5.4
• CVE-2026-34034Coolify is an open-source and self-hostable tool for managin…8.8
• CVE-2026-34035Coolify is an open-source and self-hostable tool for managin…8.8
• CVE-2026-34036Dolibarr is an enterprise resource planning (ERP) and custom…6.5
• CVE-2026-34037Coolify is an open-source and self-hostable tool for managin…9.9
• CVE-2026-3404A flaw has been found in thinkgem JeeSite up to 5.15.1. Impa…8.1
• CVE-2026-34040Moby is an open source container framework. Prior to version…7.8
• CVE-2026-34041act is a project which allows for local running of github ac…9.8
• CVE-2026-34042act is a project which allows for local running of github ac…8.2
• CVE-2026-34043Serialize JavaScript to a superset of JSON that includes reg…7.5
• CVE-2026-34044Coolify is an open-source and self-hostable tool for managin…7.7