CVE-2026-34048: Coolify improper authorization in terminal websocket routes

CVE-2026-34048 · Severity: critical · CVSS 9.9 · Published 2026-07-07

Coolify is an open-source platform used to manage and automate the deployment of servers, applications, and databases. A security flaw was found where the system failed to properly verify if a user had permission to access the server terminal. This allows a low-privileged team member to bypass restrictions and execute arbitrary commands with administrative (root) privileges on managed servers, potentially leading to full system takeover, data theft, or service disruption.

Technologies: Coollabs Coolify. Vendors: Coollabs.

Quick answers

Is CVE-2026-34048 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-34048 being exploited in the wild.
How severe is CVE-2026-34048?
Critical severity, with a CVSS score of 9.9, published 7 July 2026.
Which products and versions are affected?
Coollabs Coolify < 4.0.0-beta.471.
Is there a fix for CVE-2026-34048?
A patch was published on 2026-04-09: Version 4.0.0-beta.471 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-34048 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-34048?
Check whether you run Coollabs Coolify at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A missing authorization check exists in the terminal websocket bootstrap routes (`POST /terminal/auth` and `POST /terminal/auth/ips`). While the main terminal UI is protected by the `can.access.terminal` middleware, these specific backend routes only verified that a user was authenticated, not that they had terminal permissions. An attacker with low-privileged 'member' access can obtain server and SSH key UUIDs from other application pages, then directly call the bootstrap routes to establish a websocket connection. Because the backend trusts attacker-controlled SSH command strings, the attacker can execute arbitrary shell commands (often as root) on any terminal-enabled server managed by the team. This has been patched in version 4.0.0-beta.471 by applying the appropriate authorization middleware to the affected routes.

Affected products

  • coollabsio Coolify < 4.0.0-beta.471

Timeline

  • 2026-04-09: patched: Version 4.0.0-beta.471 released
  • 2026-07-02: advisory: GitHub Security Advisory published
  • 2026-07-07: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.