CVE-2026-34599: Coolify: Authenticated Remote Code Execution in GetLogs Livewire Component
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, there is an authenticated command injection vulnerability in the GetLogs Livewire component which allows users with team membership (lowest privilege member role) to execute arbitrary commands as root on managed servers. The $container Livewire public property is interpolated directly into shell commands (docker logs, docker service logs) without sanitization, and can be modified by any client via the Livewire wire protocol because it lacks the #[Locked] attribute. This issue is fixed in version 4.0.0-beta.471.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Coolify GetLogs Livewire componentto a version that resolves this vulnerability.Fixed in 4.0.0-beta.471
Event History
Frequently Asked Questions
What is the severity of CVE-2026-34599?
The severity of CVE-2026-34599 is rated as high with a score of 8.8.
What is CVE-2026-34599 about?
CVE-2026-34599 is an authenticated remote code execution vulnerability found in the GetLogs Livewire component of Coolify.
How do I fix CVE-2026-34599?
To fix CVE-2026-34599, upgrade Coolify to version 4.0.0-beta.471 or later.
What privileges are required to exploit CVE-2026-34599?
CVE-2026-34599 can be exploited by users with team membership, including the lowest privilege member role.
What type of vulnerability is CVE-2026-34599?
CVE-2026-34599 is classified as an OS Command Injection vulnerability.