Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, there is an authenticated command injection vulnerability in the GetLogs Livewire component which allows users with team membership (lowest privilege member role) to execute arbitrary commands as root on managed servers. The $container Livewire public property is interpolated directly into shell commands (docker logs, docker service logs) without sanitization, and can be modified by any client via the Livewire wire protocol because it lacks the #[Locked] attribute. This issue is fixed in version 4.0.0-beta.471.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-34599 Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, there is an authenticated command injecti… https://www.cve.org/CVERecord?id=CVE-2026-34599
Post summary
The entry cites CVE-2026-34599 as an authenticated command injection issue in Coolify but offers no PoC, exploit, patch, or active use details.
🚨*CVE* CVE-2026-34599 Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, there is an authenticated command injecti… https://www.cve.org/CVERecord?id=CVE-2026-34599 ----- Traducción: CVE-2026-34599 Coo… http://infoflow.cloud`
Post summary
The post discloses that Coolify versions prior to 4.0.0‑beta.471 are vulnerable to authenticated command injection, without providing PoC or exploit details.