Is CVE-2026-34047 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-34047 being exploited in the wild.

How severe is CVE-2026-34047?

Critical severity, with a CVSS score of 9.9, published 7 July 2026.

Which products and versions are affected?

coollabsio Coolify < 4.0.0-beta.471.

Is there a fix for CVE-2026-34047?

A patch was published on 2026-03-25: Fix merged into development branch via PR #9169 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-34047 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-34047?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-34047: Coolify incorrect authorization in terminal WebSocket routes

Q: Which products and versions are affected?

coollabsio Coolify < 4.0.0-beta.471.

Q: Is there a fix for CVE-2026-34047?

A patch was published on 2026-03-25: Fix merged into development branch via PR #9169 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-34047 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-34047?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-34047 · Severity: critical · CVSS 9.9 · Published 2026-07-07

Coolify is an open-source platform used to manage servers, applications, and databases from a single dashboard. A security flaw in the terminal management component allowed users with low-level access to bypass restrictions and gain full command-line control over managed servers. This could allow an attacker to steal sensitive data, modify infrastructure, or gain root access to the underlying host machines.

Quick answers

Is CVE-2026-34047 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-34047 being exploited in the wild.
How severe is CVE-2026-34047?: Critical severity, with a CVSS score of 9.9, published 7 July 2026.
Which products and versions are affected?: coollabsio Coolify < 4.0.0-beta.471.
Is there a fix for CVE-2026-34047?: A patch was published on 2026-03-25: Fix merged into development branch via PR #9169 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-34047 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-34047?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An incorrect authorization vulnerability (CWE-863) existed in Coolify's terminal WebSocket flow. While the frontend and the main GET /terminal route enforced the 'can.access.terminal' gate (restricting access to admins and owners), the backend bootstrap endpoints POST /terminal/auth and POST /terminal/auth/ips only verified general authentication. A low-privileged 'Member' user could bypass the UI, call these endpoints to obtain a list of terminal-enabled hosts, and establish a WebSocket connection to execute commands. In some scenarios, this could be escalated to root-level remote code execution by retrieving SSH private keys or generating API tokens. The fix applies the 'can.access.terminal' middleware to the vulnerable POST routes.

Affected products

coollabsio Coolify < 4.0.0-beta.471

Timeline

2026-03-25: patched: Fix merged into development branch via PR #9169
2026-04-09: advisory: Version 4.0.0-beta.471 released
2026-07-02: advisory: GitHub Security Advisory published
2026-07-07: disclosed: CVE-2026-34047 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.