Is CVE-2026-34152 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-34152 being exploited in the wild.

How severe is CVE-2026-34152?

High severity, with a CVSS score of 8.8, published 7 July 2026.

Which products and versions are affected?

Coollabs Coolify < 4.0.0-beta.471.

Is there a fix for CVE-2026-34152?

A patch was published on 2026-03-25: Fix committed to repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-34152 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-34152?

Check whether you run Coollabs Coolify at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-34152: Coolabsio Coolify OS command injection in deployment commands

Q: Which products and versions are affected?

Coollabs Coolify < 4.0.0-beta.471.

Q: Is there a fix for CVE-2026-34152?

A patch was published on 2026-03-25: Fix committed to repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-34152 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-34152?

Check whether you run Coollabs Coolify at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-34152 · Severity: high · CVSS 8.8 · Published 2026-07-07

Coolify, an open-source tool used to manage servers and application deployments, is vulnerable to a security flaw that allows authenticated users to execute unauthorized commands. By including specific characters in deployment settings, a user could bypass security filters and run arbitrary code on the remote servers being managed. This could lead to a complete takeover of the connected infrastructure and exposure of sensitive application data.

Technologies: Coollabs Coolify. Vendors: Coollabs.

Quick answers

Is CVE-2026-34152 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-34152 being exploited in the wild.
How severe is CVE-2026-34152?: High severity, with a CVSS score of 8.8, published 7 July 2026.
Which products and versions are affected?: Coollabs Coolify < 4.0.0-beta.471.
Is there a fix for CVE-2026-34152?: A patch was published on 2026-03-25: Fix committed to repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-34152 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-34152?: Check whether you run Coollabs Coolify at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A command injection vulnerability exists in Coolify prior to version 4.0.0-beta.471. While pre-deployment and post-deployment commands were single-quote escaped, they were subsequently transmitted via an SSH heredoc transport that preserves newlines. An authenticated attacker can exploit this by injecting newline characters followed by additional shell commands, which bypass the escaping and execute on the remote target server during the deployment process. The fix involves normalizing whitespace and validating these command fields to prevent newline-based injection.

Affected products

coollabsio Coolify < 4.0.0-beta.471

Timeline

2026-03-25: patched: Fix committed to repository
2026-04-09: advisory: Release v4.0.0-beta.471 published
2026-07-07: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.