# CVE-2026-34048: Coolify improper authorization in terminal websocket routes

Source: https://junglewise.ai/threats/cve-2026-34048-coolify-improper-authorization-in-terminal-websocket-routes  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-07. Updated: 2026-07-07  
License: CC BY 4.0 with a link back

CVE-2026-34048 · Severity: critical · CVSS 9.9 · Published 2026-07-07

Coolify is an open-source platform used to manage and automate the deployment of servers, applications, and databases. A security flaw was found where the system failed to properly verify if a user had permission to access the server terminal. This allows a low-privileged team member to bypass restrictions and execute arbitrary commands with administrative (root) privileges on managed servers, potentially leading to full system takeover, data theft, or service disruption.

Technologies: [Coollabs Coolify](https://junglewise.ai/threats/technologies/coolify). Vendors: [Coollabs](https://junglewise.ai/threats/vendors/coollabs).

## Quick answers

**Is CVE-2026-34048 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-34048 being exploited in the wild.

**How severe is CVE-2026-34048?** Critical severity, with a CVSS score of 9.9, published 7 July 2026.

**Which products and versions are affected?** Coollabs Coolify < 4.0.0-beta.471.

**Is there a fix for CVE-2026-34048?** A patch was published on 2026-04-09: Version 4.0.0-beta.471 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-34048 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-34048?** Check whether you run Coollabs Coolify at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A missing authorization check exists in the terminal websocket bootstrap routes (`POST /terminal/auth` and `POST /terminal/auth/ips`). While the main terminal UI is protected by the `can.access.terminal` middleware, these specific backend routes only verified that a user was authenticated, not that they had terminal permissions. An attacker with low-privileged 'member' access can obtain server and SSH key UUIDs from other application pages, then directly call the bootstrap routes to establish a websocket connection. Because the backend trusts attacker-controlled SSH command strings, the attacker can execute arbitrary shell commands (often as root) on any terminal-enabled server managed by the team. This has been patched in version 4.0.0-beta.471 by applying the appropriate authorization middleware to the affected routes.

## Affected products

- coollabsio Coolify < 4.0.0-beta.471

## Timeline

- 2026-04-09: patched: Version 4.0.0-beta.471 released
- 2026-07-02: advisory: GitHub Security Advisory published
- 2026-07-07: disclosed: CVE published to NVD

## References

- [https://github.com/coollabsio/coolify/commit/847166a3f89b7c80972fa0d2e5c754976f95b6ad](https://github.com/coollabsio/coolify/commit/847166a3f89b7c80972fa0d2e5c754976f95b6ad)
- [https://github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.471](https://github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.471)
- [https://github.com/coollabsio/coolify/security/advisories/GHSA-mw6q-2hmg-mhxv](https://github.com/coollabsio/coolify/security/advisories/GHSA-mw6q-2hmg-mhxv)

## Related threats

- [Coolify information disclosure via webhook enumeration](https://junglewise.ai/threats/cve-2026-121587-coolify-before-4-1-1-contains-an-information-disclosure)
- [Coollabsio Coolify path traversal in PostgreSQL init scripts](https://junglewise.ai/threats/cve-2026-42200-coollabsio-coolify-path-traversal-in-postgresql-init-scripts)
- [Coollabs Coolify insufficient session expiration for API tokens](https://junglewise.ai/threats/cve-2026-42172-coollabs-coolify-insufficient-session-expiration-for-api-tokens)
- [Coollabsio Coolify SSRF in S3 storage endpoint validation](https://junglewise.ai/threats/cve-2026-42147-coollabsio-coolify-ssrf-in-s3-storage-endpoint-validation)
- [Coolify account takeover via CSRF in invitation endpoint](https://junglewise.ai/threats/cve-2026-34171-coolify-account-takeover-via-csrf-in-invitation-endpoint)