CVE-2026-34048CWE-285CWE-862

Coolify: Missing authorization on terminal websocket bootstrap routes allows low-privileged members to execute commands on team servers

Critical · published July 7, 2026

CVSS v3.1
9.9
EPSS
1%
Percentile
56.1
In the wild
Unconfirmed
What it is

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, terminal websocket bootstrap routes only check authentication and do not enforce terminal authorization, allowing a low-privileged team member to connect to terminal routes and execute commands on team servers. This issue is fixed in version 4.0.0-beta.471.

The record
Technical detail
CVSS v3.1
9.9 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00798 · 56.1th percentile
Weaknesses
CWE-285 · Improper Authorization; CWE-862 · Missing Authorization
Published
2026-07-07T03:19Z
EPSS history
Timeline
  • 07 JUL 03:19Z
    Coolify: Missing authorization on terminal websocket bootstrap routes allows low-privileged members to execute commands on team servers
    cvelistv5