Ghostwire

CVE-2026-34048: Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to...

CRITICAL CVSS 9.9 Exploit Available

Published: July 7, 2026 | Last Modified: July 8, 2026

Description

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, terminal websocket bootstrap routes only check authentication and do not enforce terminal authorization, allowing a low-privileged team member to connect to terminal routes and execute commands on team servers. This issue is fixed in version 4.0.0-beta.471.

Ghostwire Analysis — What This Means Practically

Critical CVSS score indicates maximum severity — remote code execution, authentication bypass, or complete system compromise is likely possible.
Exploit code is reported to be available, increasing the likelihood of active exploitation.

This analysis is generated by Ghostwire from NVD, CISA KEV, EPSS, and open-source intelligence data. Verify findings through primary sources before acting.

CVE-2026-34048: Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to...

Description

Ghostwire Analysis — What This Means Practically

Security Coverage (1 articles)

References