by Kastro
Paper/Archive/CVE-2026-34047

CVE-2026-34047

coollabsio coolify — Coolify: WebSocket Endpoint Access Control Flaw Leading to Remote Code Execution

EPSS 0.6%public exploitCVSS 9.9
critical.is priorityof 100
49
CVSS 9.9 (CNA)9.9 / 10 × 3029.7Not in CISA KEV+300.0EPSS percentile 46.1.461 × 209.2Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, terminal WebSocket bootstrap routes did not enforce the expected authorization middleware, allowing an authenticated user to access terminal functionality for resources outside the authorized scope and potentially execute commands. This issue is fixed in version 4.0.0-beta.471.

Affected

ProductAffectedFixed inSource
coolify< 4.0.0-beta.471–CNA

Scores by source

GitHub_M (CNA)9.9CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: total

References

exploitgithub.com/coollabsio/coolify/security/advisories/GHSA-652w-qv22-2r7crefgithub.com/coollabsio/coolify/pull/9169refgithub.com/coollabsio/coolify/commit/bc91b41f92f1bbb53886a5d7a60335cbf1621cd5refgithub.com/coollabsio/coolify/releases/tag/v4.0.0-beta.471