CVE-2026-34594

{
  "id": "CVE-2026-34594",
  "sourceIdentifier": "[email protected]",
  "published": "2026-06-29T21:16:43.840",
  "lastModified": "2026-10-25T21:10:00.770",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, an authenticated command injection vulnerability in the Destination Network Management functionality allows users with destination management permissions to execute arbitrary commands as root on managed servers. The \"network\" parameter is passed directly to shell commands without proper sanitization, enabling full remote code execution on the host system. This vulnerability is fixed in 4.0.0-beta.471."
    },
    {
      "lang": "es",
      "value": "Coolify es una herramienta de código abierto y autoalojable para gestionar servidores, aplicaciones y bases de datos. Antes de la versión 4.0.0-beta.471, una vulnerabilidad de inyección de comandos autenticada en la funcionalidad de Gestión de Red de Destino permite a los usuarios con permisos de gestión de destino ejecutar comandos arbitrarios como root en los servidores gestionados. El parámetro ’network’ se pasa directamente a los comandos de shell sin una sanitización adecuada, lo que permite la ejecución remota de código completa en el sistema anfitrión. Esta vulnerabilidad se corrigió en la versión 4.0.0-beta.471."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "coollabsio",
          "product": "coolify",
          "versions": [
            {
              "version": "< 4.0.0-beta.471",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-01T14:22:37.720820Z",
          "id": "CVE-2026-34594",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-78"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/coollabsio/coolify/security/advisories/GHSA-mf8p-rj62-9f9m",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/coollabsio/coolify/security/advisories/GHSA-mf8p-rj62-9f9m",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ]
}