Vulnerability Description
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, terminal WebSocket bootstrap routes did not enforce the expected authorization middleware, allowing an authenticated user to access terminal functionality for resources outside the authorized scope and potentially execute commands. This issue is fixed in version 4.0.0-beta.471.
CVSS Score
CRITICAL
Related Weaknesses (CWE)
References
- https://github.com/coollabsio/coolify/commit/bc91b41f92f1bbb53886a5d7a60335cbf16
- https://github.com/coollabsio/coolify/pull/9169
- https://github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.471
- https://github.com/coollabsio/coolify/security/advisories/GHSA-652w-qv22-2r7c
- https://github.com/coollabsio/coolify/security/advisories/GHSA-652w-qv22-2r7c
FAQ
What is CVE-2026-34047?
CVE-2026-34047 is a vulnerability with a CVSS score of 9.9 (CRITICAL). Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, terminal WebSocket bootstrap routes did not enforce the expected authorizat...
How severe is CVE-2026-34047?
CVE-2026-34047 has been rated CRITICAL with a CVSS base score of 9.9/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2026-34047?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.