CVE-2026-34152

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-34152", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-25T20:12:04.196Z", "datePublished": "2026-07-07T03:11:14.111Z", "dateUpdated": "2026-07-09T14:42:58.988Z"}, "containers": {"cna": {"title": "Coolify: Command Injection via Newline in Pre/Post Deployment Commands (Heredoc Transport)", "problemTypes": [{"descriptions": [{"cweId": "CWE-78", "lang": "en", "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/coollabsio/coolify/security/advisories/GHSA-5qp8-9gg7-4c86", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/coollabsio/coolify/security/advisories/GHSA-5qp8-9gg7-4c86"}, {"name": "https://github.com/coollabsio/coolify/pull/9173", "tags": ["x_refsource_MISC"], "url": "https://github.com/coollabsio/coolify/pull/9173"}, {"name": "https://github.com/coollabsio/coolify/commit/ad95d65aca064f49b38f73f88d61f842737d5463", "tags": ["x_refsource_MISC"], "url": "https://github.com/coollabsio/coolify/commit/ad95d65aca064f49b38f73f88d61f842737d5463"}, {"name": "https://github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.471", "tags": ["x_refsource_MISC"], "url": "https://github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.471"}], "affected": [{"vendor": "coollabsio", "product": "coolify", "versions": [{"version": "< 4.0.0-beta.471", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-07T03:11:14.111Z"}, "descriptions": [{"lang": "en", "value": "Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, pre-deployment and post-deployment commands are single-quote escaped but then sent through SSH heredoc transport that preserves newlines, allowing an authenticated user to inject additional shell statements that execute on the remote server during deployment. This issue is fixed in version 4.0.0-beta.471."}], "source": {"advisory": "GHSA-5qp8-9gg7-4c86", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-09T14:31:18.948810Z", "id": "CVE-2026-34152", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-09T14:42:58.988Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-34152", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-07-09T14:31:18.948810Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-09T14:31:19.623Z"}}], "cna": {"title": "Coolify: Command Injection via Newline in Pre/Post Deployment Commands (Heredoc Transport)", "source": {"advisory": "GHSA-5qp8-9gg7-4c86", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "coollabsio", "product": "coolify", "versions": [{"status": "affected", "version": "< 4.0.0-beta.471"}]}], "references": [{"url": "https://github.com/coollabsio/coolify/security/advisories/GHSA-5qp8-9gg7-4c86", "name": "https://github.com/coollabsio/coolify/security/advisories/GHSA-5qp8-9gg7-4c86", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/coollabsio/coolify/pull/9173", "name": "https://github.com/coollabsio/coolify/pull/9173", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/coollabsio/coolify/commit/ad95d65aca064f49b38f73f88d61f842737d5463", "name": "https://github.com/coollabsio/coolify/commit/ad95d65aca064f49b38f73f88d61f842737d5463", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.471", "name": "https://github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.471", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, pre-deployment and post-deployment commands are single-quote escaped but then sent through SSH heredoc transport that preserves newlines, allowing an authenticated user to inject additional shell statements that execute on the remote server during deployment. This issue is fixed in version 4.0.0-beta.471."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-78", "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-07T03:11:14.111Z"}}}, "cveMetadata": {"cveId": "CVE-2026-34152", "state": "PUBLISHED", "dateUpdated": "2026-07-09T14:42:58.988Z", "dateReserved": "2026-03-25T20:12:04.196Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-07-07T03:11:14.111Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "coolify", "vendor": "coollabsio", "versions": [{"status": "affected", "version": "< 4.0.0-beta.471"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, pre-deployment and post-deployment commands are single-quote escaped but then sent through SSH heredoc transport that preserves newlines, allowing an authenticated user to inject additional shell statements that execute on the remote server during deployment. This issue is fixed in version 4.0.0-beta.471."}, {"lang": "es", "value": "Coolify es una herramienta de c\u00f3digo abierto y autoalojable para gestionar servidores, aplicaciones y bases de datos. Antes de la versi\u00f3n 4.0.0-beta.471, los comandos de predespliegue y postdespliegue est\u00e1n escapados con comillas simples pero luego se env\u00edan a trav\u00e9s de un transporte heredoc SSH que preserva los saltos de l\u00ednea, permitiendo a un usuario autenticado inyectar sentencias de shell adicionales que se ejecutan en el servidor remoto durante el despliegue. Este problema est\u00e1 solucionado en la versi\u00f3n 4.0.0-beta.471."}], "id": "CVE-2026-34152", "lastModified": "2026-10-25T20:10:00.147", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-34152", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-07-09T14:31:18.948810Z", "version": "2.0.3"}}]}, "published": "2026-07-07T04:17:50.043", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/coollabsio/coolify/commit/ad95d65aca064f49b38f73f88d61f842737d5463"}, {"source": "security-advisories@github.com", "url": "https://github.com/coollabsio/coolify/pull/9173"}, {"source": "security-advisories@github.com", "url": "https://github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.471"}, {"source": "security-advisories@github.com", "url": "https://github.com/coollabsio/coolify/security/advisories/GHSA-5qp8-9gg7-4c86"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-78"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,4.0.0-beta.471)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "coolify", "source": "cna", "vendor": "coollabsio"}, "product": "coolify", "vendor": "coollabsio"}], "created": "2026-07-07T04:45:15.746974+00:00", "updated": "2026-08-03T05:15:18.527933+00:00", "vendors": ["coollabsio", "coollabsio$PRODUCT$coolify"]}