CVE-2026-34057: Coolify command injection in database import component

CVE-2026-34057 · Severity: high · CVSS 8.8 · Published 2026-07-07

Coolify, an open-source tool for managing servers and databases, contains a security flaw in its database import feature. An authenticated user with basic team access can inject malicious commands into the system by manipulating the name of a database container. If exploited, this allows an attacker to take full control of the managed servers, potentially leading to data theft, service disruption, or unauthorized access to the entire infrastructure.

Technologies: Coollabs Coolify. Vendors: Coollabs.

Quick answers

Is CVE-2026-34057 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-34057 being exploited in the wild.
How severe is CVE-2026-34057?
High severity, with a CVSS score of 8.8, published 7 July 2026.
Which products and versions are affected?
Coollabs Coolify < 4.0.0-beta.471.
Is there a fix for CVE-2026-34057?
A patch was published on 2026-03-25: Fix committed to repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-34057 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-34057?
Check whether you run Coollabs Coolify at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An authenticated command injection vulnerability exists in the Database Import functionality (app/Livewire/Project/Database/Import.php) of Coolify. The '$container' Livewire public property lacks the '#[Locked]' attribute, allowing a client to modify it via the Livewire wire protocol. This property is subsequently interpolated directly into shell commands (such as 'docker exec' and 'docker cp') without sanitization or validation. An attacker with at least team-level privileges can exploit this to execute arbitrary commands as root on managed servers. This vulnerability represents a bypass of previous fixes (GHSA-q33h-22xm-4cgh) and is addressed in version 4.0.0-beta.471 by adding locked attributes and consolidating container name validation.

Affected products

  • coollabsio Coolify < 4.0.0-beta.471

Timeline

  • 2026-03-25: patched: Fix committed to repository
  • 2026-07-02: advisory: GitHub Security Advisory published
  • 2026-07-07: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.