Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.466, log drain secret and environment va…

CVE-2026-34035 affects Coolify, an open-source self-hostable server and application management tool. Prior to version 4.0.0-beta.466, log drain secret and environment variable values were interpolated directly into shell commands without proper encoding or sanitization. This flaw allowed authenticated users to inject arbitrary commands that would be executed on the host system. The vulnerability represents a command injection risk with potential for full host compromise by any authenticated user. The issue has been patched in version 4.0.0-beta.466. A fix commit is available on GitHub along with a security advisory. Users of affected versions should upgrade immediately to mitigate the risk of authenticated command injection attacks.