CVE-2026-34158: Coolify: Command injection via single-quote breakout in Docker Compose custom commands
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.469, the executeInDocker() helper wraps user-controlled commands in single quotes without escaping embedded single quotes. Attackers who can edit application settings can inject a single quote into dockercomposecustombuildcommand or dockercomposecustomstartcommand to break out of the quoted context and execute arbitrary commands on the managed server host during deployments, escaping the intended Docker container confinement. This issue is fixed in version 4.0.0-beta.469.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Coolifyto a version that resolves this vulnerability.Fixed in 4.0.0-beta.469
Event History
Frequently Asked Questions
What is the severity of CVE-2026-34158?
The severity of CVE-2026-34158 is high with a score of 8.8.
How do I fix CVE-2026-34158?
To fix CVE-2026-34158, upgrade Coolify to version 4.0.0-beta.469 or later.
What type of vulnerability is CVE-2026-34158?
CVE-2026-34158 is an OS Command Injection vulnerability.
Who can exploit CVE-2026-34158?
Attackers who can edit application settings in Coolify can exploit CVE-2026-34158.
What can attackers achieve through CVE-2026-34158?
Attackers can execute arbitrary commands on the system due to improper handling of user-controlled commands in Coolify.