Coolify Destination Command Injection RCE Vulnerability (CVE-2026-34594) Analysis and PoC

Vulnerability Overview Title: Authenticated Remote Code Execution via Command Injection in Destination Network Management Description: An authenticated command injection vulnerability was discovered in the Destination Network Management feature. This vulnerability allows users with destination management permissions to execute arbitrary commands as root on managed servers. The "network" parameter is passed directly to shell commands without proper sanitization, resulting in full remote code execution on the host system. Scope Affected Versions: <= v4.0.0-beta.470 Fixed Version: v4.0.0-beta.471 CVSS Score: 8.8 / 10 CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H CVE ID: CVE-2026-34594 Weakness: CWE-78 Remediation Update to the Fixed Version: Upgrade to v4.0.0-beta.471 or higher. POC Code Exploitation Steps 1. Start a ncat listener on the attacker's machine. 2. Log in to Coolify and navigate to "Destinations". 3. Click "+ Add" and modify the "Network" field with the following content: 4. Click "Continue". 5. After creating the destination, click "Delete Destination". 6. Enter the correct "Destination Name" to confirm the action and click "Permanently Delete". 7. A root shell will be received on the attacker's listener. Impact Remote Code Execution: The attacker can execute arbitrary commands on the managed server. Root Privileges: All commands are executed as root due to Coolify's sudo injection mechanism. Full Server Compromise: The attacker gains complete control over the management infrastructure. Data Contamination: Any subsequent commands processing this unsanitized network data are vulnerable to manipulation. Lateral Movement: Managed servers can be used to attack other managed resources. Data Leakage: Access to all applications, databases, and secrets managed by Coolify.

Goal Reached Thanks to every supporter — we hit 100%!

Coolify Destination Command Injection RCE Vulnerability (CVE-2026-34594) Analysis and PoC

More from this source