# CVE-2026-34047: Coolify incorrect authorization in terminal WebSocket routes

Source: https://junglewise.ai/threats/cve-2026-34047-coolify-incorrect-authorization-in-terminal-websocket-routes  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-07. Updated: 2026-07-07  
License: CC BY 4.0 with a link back

CVE-2026-34047 · Severity: critical · CVSS 9.9 · Published 2026-07-07

Coolify is an open-source platform used to manage servers, applications, and databases from a single dashboard. A security flaw in the terminal management component allowed users with low-level access to bypass restrictions and gain full command-line control over managed servers. This could allow an attacker to steal sensitive data, modify infrastructure, or gain root access to the underlying host machines.

## Quick answers

**Is CVE-2026-34047 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-34047 being exploited in the wild.

**How severe is CVE-2026-34047?** Critical severity, with a CVSS score of 9.9, published 7 July 2026.

**Which products and versions are affected?** coollabsio Coolify < 4.0.0-beta.471.

**Is there a fix for CVE-2026-34047?** A patch was published on 2026-03-25: Fix merged into development branch via PR #9169 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-34047 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-34047?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An incorrect authorization vulnerability (CWE-863) existed in Coolify's terminal WebSocket flow. While the frontend and the main GET /terminal route enforced the 'can.access.terminal' gate (restricting access to admins and owners), the backend bootstrap endpoints POST /terminal/auth and POST /terminal/auth/ips only verified general authentication. A low-privileged 'Member' user could bypass the UI, call these endpoints to obtain a list of terminal-enabled hosts, and establish a WebSocket connection to execute commands. In some scenarios, this could be escalated to root-level remote code execution by retrieving SSH private keys or generating API tokens. The fix applies the 'can.access.terminal' middleware to the vulnerable POST routes.

## Affected products

- coollabsio Coolify < 4.0.0-beta.471

## Timeline

- 2026-03-25: patched: Fix merged into development branch via PR #9169
- 2026-04-09: advisory: Version 4.0.0-beta.471 released
- 2026-07-02: advisory: GitHub Security Advisory published
- 2026-07-07: disclosed: CVE-2026-34047 published to NVD

## References

- [https://github.com/coollabsio/coolify/commit/bc91b41f92f1bbb53886a5d7a60335cbf1621cd5](https://github.com/coollabsio/coolify/commit/bc91b41f92f1bbb53886a5d7a60335cbf1621cd5)
- [https://github.com/coollabsio/coolify/pull/9169](https://github.com/coollabsio/coolify/pull/9169)
- [https://github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.471](https://github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.471)
- [https://github.com/coollabsio/coolify/security/advisories/GHSA-652w-qv22-2r7c](https://github.com/coollabsio/coolify/security/advisories/GHSA-652w-qv22-2r7c)