# CVE-2026-34035: coollabsio Coolify command injection in Log Drain configuration

Source: https://junglewise.ai/threats/cve-2026-34035-coollabsio-coolify-command-injection-in-log-drain-configuration  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-07. Updated: 2026-07-07  
License: CC BY 4.0 with a link back

CVE-2026-34035 · Severity: high · CVSS 8.8 · Published 2026-07-07

Coolify is an open-source platform used to manage and host servers, applications, and databases. A security flaw in the log management component allows an authorized user to execute malicious commands on the underlying server. This could lead to a complete takeover of the hosting infrastructure, unauthorized access to sensitive data, and disruption of all hosted services.

## Quick answers

**Is CVE-2026-34035 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-34035 being exploited in the wild.

**How severe is CVE-2026-34035?** High severity, with a CVSS score of 8.8, published 7 July 2026.

**Which products and versions are affected?** coollabsio Coolify < 4.0.0-beta.466.

**Is there a fix for CVE-2026-34035?** A patch was published on 2026-03-11: Fixed in version 4.0.0-beta.466 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-34035 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-34035?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An OS command injection vulnerability (CWE-78) exists in Coolify's log drain configuration logic within 'app/Actions/Server/StartLogDrain.php' and 'app/Livewire/Server/LogDrains.php'. The application constructs shell commands by interpolating user-provided log drain secrets (such as Axiom API keys) directly into unquoted 'echo' commands. An authenticated attacker with access to server settings can provide a crafted payload containing shell metacharacters (e.g., '$(id)') to achieve Remote Code Execution (RCE) on the host server. The issue has been addressed in version 4.0.0-beta.466 by implementing base64 encoding for environment variables and adding regex validation for input fields.

## Affected products

- coollabsio Coolify < 4.0.0-beta.466

## Timeline

- 2026-03-04: disclosed: Vulnerability discovered by Xyptonize
- 2026-03-11: patched: Fixed in version 4.0.0-beta.466
- 2026-07-07: advisory: CVE-2026-34035 published

## References

- [https://github.com/coollabsio/coolify/commit/fcd574e1eb1c2f504c48e5be4a5cb6d69f8f1f55](https://github.com/coollabsio/coolify/commit/fcd574e1eb1c2f504c48e5be4a5cb6d69f8f1f55)
- [https://github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.466](https://github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.466)
- [https://github.com/coollabsio/coolify/security/advisories/GHSA-3xm2-hqg8-4m2p](https://github.com/coollabsio/coolify/security/advisories/GHSA-3xm2-hqg8-4m2p)