# CVE-2026-34037: Coolify cross-tenant resource cloning in ResourceOperations.php

Source: https://junglewise.ai/threats/cve-2026-34037-coolify-cross-tenant-resource-cloning-in-resourceoperations-php  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-07. Updated: 2026-07-07  
License: CC BY 4.0 with a link back

CVE-2026-34037 · Severity: critical · CVSS 9.9 · Published 2026-07-07

Coolify is an open-source platform used to manage and deploy servers, applications, and databases. A security flaw in the resource management system allows an authenticated user to bypass team boundaries and clone or move resources (like applications or databases) onto servers owned by other teams. This could lead to unauthorized access to another team's infrastructure, potential data exposure, and the ability to run arbitrary code on their servers.

## Quick answers

**Is CVE-2026-34037 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-34037 being exploited in the wild.

**How severe is CVE-2026-34037?** Critical severity, with a CVSS score of 9.9, published 7 July 2026.

**Which products and versions are affected?** coollabsio Coolify < 4.0.0-beta.464.

**Is there a fix for CVE-2026-34037?** A patch was published on 2026-02-25: Fix commit authored Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-34037 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-34037?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in the cloneTo() and moveTo() Livewire actions within ResourceOperations.php. While the application authorizes the source resource, it resolves destination resources (servers or environments) using unscoped Eloquent lookups (e.g., StandaloneDocker::find($destination_id)) without verifying that the destination belongs to the current user's team. Furthermore, the StandaloneDockerPolicy::update() method was found to return 'true' unconditionally, bypassing intended authorization checks. An attacker can exploit this by intercepting the Livewire POST request and replacing the destination ID with a sequential integer corresponding to another team's server. This allows for cross-tenant resource deployment and potential infrastructure takeover. The issue is fixed in version 4.0.0-beta.464 by implementing team-scoped lookups.

## Affected products

- coollabsio Coolify < 4.0.0-beta.464

## Timeline

- 2026-02-25: patched: Fix commit authored
- 2026-03-09: advisory: Release v4.0.0-beta.464 published
- 2026-07-02: disclosed: Security advisory published on GitHub
- 2026-07-07: advisory: NVD publication date

## References

- [https://github.com/coollabsio/coolify/commit/1759a1631cd63271ebf6caa250c6d93440eaa333](https://github.com/coollabsio/coolify/commit/1759a1631cd63271ebf6caa250c6d93440eaa333)
- [https://github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.464](https://github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.464)
- [https://github.com/coollabsio/coolify/security/advisories/GHSA-ggrr-wrvr-x83v](https://github.com/coollabsio/coolify/security/advisories/GHSA-ggrr-wrvr-x83v)