Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, terminal websocket bootstrap routes…

CVE-2026-34048 is a vulnerability in Coolify, an open-source self-hostable server and application management tool. Prior to version 4.0.0-beta.471, the terminal WebSocket bootstrap routes only verified authentication but did not enforce proper authorization controls. This flaw allowed low-privileged team members to connect to terminal routes and execute arbitrary commands on team servers. The vulnerability represents a broken access control issue where authentication and authorization were not properly separated. The impact is significant as it enables privilege escalation within a team context, potentially compromising all servers managed by the Coolify instance. The issue has been patched in version 4.0.0-beta.471. Users are strongly advised to upgrade immediately to mitigate the risk of unauthorized command execution on managed infrastructure.