CVE-2026-34047CWE-863

Coolify: WebSocket Endpoint Access Control Flaw Leading to Remote Code Execution

Critical · published July 7, 2026

CVSS v3.1
9.9
EPSS
1%
Percentile
53.0
In the wild
Unconfirmed
What it is

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, terminal WebSocket bootstrap routes did not enforce the expected authorization middleware, allowing an authenticated user to access terminal functionality for resources outside the authorized scope and potentially execute commands. This issue is fixed in version 4.0.0-beta.471.

The record
Technical detail
CVSS v3.1
9.9 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00711 · 53.0th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2026-07-07T02:54Z
EPSS history
Timeline
  • 07 JUL 02:54Z
    Coolify: WebSocket Endpoint Access Control Flaw Leading to Remote Code Execution
    cvelistv5