CVE-2026-34047

EUVD-2026-41981
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, terminal WebSocket bootstrap routes did not enforce the expected authorization middleware, allowing an authenticated user to access terminal functionality for resources outside the authorized scope and potentially execute commands. This issue is fixed in version 4.0.0-beta.471.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.9 CRITICAL
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 29%
Common Weakness Enumeration
Vulnerability Media Exposure
References
https://github.com/coollabsio/coolify/commit/bc91b41f92f1bbb53886a5d7a60335cbf1621cd5
https://github.com/coollabsio/coolify/pull/9169
https://github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.471
https://github.com/coollabsio/coolify/security/advisories/GHSA-652w-qv22-2r7c
https://github.com/coollabsio/coolify/security/advisories/GHSA-652w-qv22-2r7c