CVE-2026-34594

highCVSS 8.8covered by 1 sourcefirst seen 2026-06-29

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, an authenticated command injection vulnerability in the Destination Network Management functionality allows users with destination management permissions to execute arbitrary commands as root on managed servers. The "network" parameter is passed directly to shell commands without proper sanitization, enabling full remote code execution on the host system. This vulnerability is fixed in 4.0.0-beta.471.

⚡ Watch CVE-2026-34594

Get an email if CVE-2026-34594 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.

Exploitation outlook

Moderate exploitation risk1.1% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 62% of all EPSS-scored CVEs.

Advisory coverage (1)

highCVE-2026-34594: Coolify is an open-source and self-hostable tool for managing servers, applications, and datab…nvd · 2026-06-29

External references

NVD record for CVE-2026-34594

CVE.org record

Embed the live status

— this badge updates automatically when the KEV or exploit status changes. How to embed it →

[![CVE-2026-34594 status](https://www.csirts.com/badge/CVE-2026-34594)](https://www.csirts.com/cve/CVE-2026-34594)