CVE-2026-34034

Coolify: Host RCE via Sentinel token injection

CVSS 8.8 HIGHEPSS 0.4%CWE-78

Vexday Risk Score

21Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 8.8EPSS 0.4%KEV nãoPoC —Nuclei —Metasploit —Patch —

Lifecycle

07 Jul 2026Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.466, the sentinel_token setting is used in shell commands without sufficient validation, allowing an authenticated user with access to server Sentinel settings to inject shell syntax and execute commands on the host when Sentinel is restarted. This issue is fixed in version 4.0.0-beta.466.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

coollabsio · coolify

References

https://github.com/coollabsio/coolify/commit/096d4369e59b3db7ace2db3ca42588c41b9b6019 https://github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.466 https://github.com/coollabsio/coolify/security/advisories/GHSA-rpr8-p7jc-x844