# CVE-2026-34058: Coollabsio Coolify OS command injection in Server Resources

Source: https://junglewise.ai/threats/cve-2026-34058-coollabsio-coolify-os-command-injection-in-server-resources  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-07. Updated: 2026-07-07  
License: CC BY 4.0 with a link back

CVE-2026-34058 · Severity: high · CVSS 8.8 · Published 2026-07-07

Coolify is an open-source platform used to manage and deploy applications, databases, and servers. A security flaw allows authenticated users to execute unauthorized commands on the remote servers managed by the platform. This could lead to a complete takeover of the managed infrastructure, data theft, or service disruption.

## Quick answers

**Is CVE-2026-34058 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-34058 being exploited in the wild.

**How severe is CVE-2026-34058?** High severity, with a CVSS score of 8.8, published 7 July 2026.

**Which products and versions are affected?** coollabsio Coolify < 4.0.0-beta.471.

**Is there a fix for CVE-2026-34058?** A patch was published on 2026-03-25: Fix merged into codebase Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-34058 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-34058?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An OS command injection vulnerability exists in Coolify's Livewire component 'Server\Resources'. The 'startUnmanaged', 'stopUnmanaged', and 'restartUnmanaged' methods accept a '$id' parameter from the browser and interpolate it directly into shell commands (e.g., 'docker stop -t 0 $id') executed via SSH on managed servers. Because the input lacks sanitization or shell escaping (such as escapeshellarg), an authenticated attacker can use command separators to execute arbitrary code with the privileges of the SSH user on the target server. The vulnerability is fixed in version 4.0.0-beta.471 by adding input validation patterns and proper shell argument escaping.

## Affected products

- coollabsio Coolify < 4.0.0-beta.471

## Timeline

- 2026-03-25: patched: Fix merged into codebase
- 2026-04-09: advisory: Release v4.0.0-beta.471 published
- 2026-07-02: disclosed: Security advisory published
- 2026-07-07: other: CVE published to NVD

## References

- [https://github.com/coollabsio/coolify/commit/944a038349216f00b390e905c121355adc8b23c1](https://github.com/coollabsio/coolify/commit/944a038349216f00b390e905c121355adc8b23c1)
- [https://github.com/coollabsio/coolify/pull/9172](https://github.com/coollabsio/coolify/pull/9172)
- [https://github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.471](https://github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.471)
- [https://github.com/coollabsio/coolify/security/advisories/GHSA-rh5x-qx77-fq9v](https://github.com/coollabsio/coolify/security/advisories/GHSA-rh5x-qx77-fq9v)