# CVE-2026-34152: Coolabsio Coolify OS command injection in deployment commands

Source: https://junglewise.ai/threats/cve-2026-34152-coolabsio-coolify-os-command-injection-in-deployment-commands  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-07. Updated: 2026-07-07  
License: CC BY 4.0 with a link back

CVE-2026-34152 · Severity: high · CVSS 8.8 · Published 2026-07-07

Coolify, an open-source tool used to manage servers and application deployments, is vulnerable to a security flaw that allows authenticated users to execute unauthorized commands. By including specific characters in deployment settings, a user could bypass security filters and run arbitrary code on the remote servers being managed. This could lead to a complete takeover of the connected infrastructure and exposure of sensitive application data.

Technologies: [Coollabs Coolify](https://junglewise.ai/threats/technologies/coolify). Vendors: [Coollabs](https://junglewise.ai/threats/vendors/coollabs).

## Quick answers

**Is CVE-2026-34152 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-34152 being exploited in the wild.

**How severe is CVE-2026-34152?** High severity, with a CVSS score of 8.8, published 7 July 2026.

**Which products and versions are affected?** Coollabs Coolify < 4.0.0-beta.471.

**Is there a fix for CVE-2026-34152?** A patch was published on 2026-03-25: Fix committed to repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-34152 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-34152?** Check whether you run Coollabs Coolify at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A command injection vulnerability exists in Coolify prior to version 4.0.0-beta.471. While pre-deployment and post-deployment commands were single-quote escaped, they were subsequently transmitted via an SSH heredoc transport that preserves newlines. An authenticated attacker can exploit this by injecting newline characters followed by additional shell commands, which bypass the escaping and execute on the remote target server during the deployment process. The fix involves normalizing whitespace and validating these command fields to prevent newline-based injection.

## Affected products

- coollabsio Coolify < 4.0.0-beta.471

## Timeline

- 2026-03-25: patched: Fix committed to repository
- 2026-04-09: advisory: Release v4.0.0-beta.471 published
- 2026-07-07: disclosed: CVE published to NVD

## References

- [https://github.com/coollabsio/coolify/commit/ad95d65aca064f49b38f73f88d61f842737d5463](https://github.com/coollabsio/coolify/commit/ad95d65aca064f49b38f73f88d61f842737d5463)
- [https://github.com/coollabsio/coolify/pull/9173](https://github.com/coollabsio/coolify/pull/9173)
- [https://github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.471](https://github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.471)
- [https://github.com/coollabsio/coolify/security/advisories/GHSA-5qp8-9gg7-4c86](https://github.com/coollabsio/coolify/security/advisories/GHSA-5qp8-9gg7-4c86)

## Related threats

- [Coolify information disclosure via webhook enumeration](https://junglewise.ai/threats/cve-2026-121587-coolify-before-4-1-1-contains-an-information-disclosure)
- [Coollabsio Coolify path traversal in PostgreSQL init scripts](https://junglewise.ai/threats/cve-2026-42200-coollabsio-coolify-path-traversal-in-postgresql-init-scripts)
- [Coollabs Coolify insufficient session expiration for API tokens](https://junglewise.ai/threats/cve-2026-42172-coollabs-coolify-insufficient-session-expiration-for-api-tokens)
- [Coollabsio Coolify SSRF in S3 storage endpoint validation](https://junglewise.ai/threats/cve-2026-42147-coollabsio-coolify-ssrf-in-s3-storage-endpoint-validation)
- [Coolify account takeover via CSRF in invitation endpoint](https://junglewise.ai/threats/cve-2026-34171-coolify-account-takeover-via-csrf-in-invitation-endpoint)