# CVE-2026-59734: Coollabs Coolify OS command injection in health check configuration

Source: https://junglewise.ai/threats/cve-2026-59734-coollabs-coolify-os-command-injection-in-health-check  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-09. Updated: 2026-07-09  
License: CC BY 4.0 with a link back

CVE-2026-59734 · Severity: high · CVSS 8.8 · Published 2026-07-09

Coolify is an open-source platform used to manage and deploy servers, applications, and databases. A security flaw allows an authorized user to execute malicious commands on the underlying system by providing specially crafted input in the health check settings. This could lead to a full takeover of the application containers and the data they manage.

## Quick answers

**Is CVE-2026-59734 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-59734 being exploited in the wild.

**How severe is CVE-2026-59734?** High severity, with a CVSS score of 8.8, published 9 July 2026.

**Which products and versions are affected?** coollabsio Coolify < 4.0.0-beta.469.

**Is there a fix for CVE-2026-59734?** A patch was published on 2026-03-20: Version 4.0.0-beta.469 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-59734 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-59734?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An OS command injection vulnerability exists in Coolify's health check configuration handling within `app/Jobs/ApplicationDeploymentJob.php`. The `generate_healthcheck_commands()` function directly interpolates user-controlled parameters—specifically `health_check_host`, `health_check_method`, and `health_check_path`—into shell commands without proper sanitization or the use of `escapeshellarg()`. An authenticated attacker with permissions to edit application settings can inject shell metacharacters (e.g., `;`, `|`, or `$()`) to achieve remote code execution (RCE) inside deployment containers. This can be exploited via the Web UI or the PATCH API endpoint for applications. The issue is resolved in version 4.0.0-beta.469.

## Affected products

- coollabsio Coolify < 4.0.0-beta.469

## Timeline

- 2026-03-20: patched: Version 4.0.0-beta.469 released
- 2026-07-02: advisory: GitHub Security Advisory published
- 2026-07-09: disclosed: CVE published to NVD

## References

- [https://github.com/coollabsio/coolify/commit/0ffcee7a4dcd24f92b5fab8c9c7be140b9532733](https://github.com/coollabsio/coolify/commit/0ffcee7a4dcd24f92b5fab8c9c7be140b9532733)
- [https://github.com/coollabsio/coolify/pull/9007](https://github.com/coollabsio/coolify/pull/9007)
- [https://github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.469](https://github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.469)
- [https://github.com/coollabsio/coolify/security/advisories/GHSA-4fhp-xqqp-w7vv](https://github.com/coollabsio/coolify/security/advisories/GHSA-4fhp-xqqp-w7vv)