Loading story…
Coolify disclosed and patched CVE-2026-59734, a high-severity OS command injection flaw that allows an authenticated remote attacker to achieve remote code execution inside deployment containers. The vulnerability affects versions prior to 4.0.0-beta.469 and stems from unsafe interpolation of user-controlled health_check_host, health_check_method, and health_check_path values in generate_healthcheck_commands() within app/Jobs/ApplicationDeploymentJob.php. The issue carries a CVSS v3.1 score of 8.8.
The fix landed in Coolify via commit 0ffcee7a4dcd24f92b5fab8c9c7be140b9532733, which adds runtime validation for user-supplied CMD health check commands with a restrictive regular expression and maximum length checks, corrects shell escaping for HTTP health check methods in generated curl commands, and falls back to HTTP health checks when validation fails. The patch also introduced HealthCheckCommandInjectionTest.php, and the vendor linked the remediation to its release, pull request, patch commit, and GitHub security advisory.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
CVE-2026-59734 was disclosed as a high-severity OS command injection vulnerability affecting Coolify versions prior to 4.0.0-beta.469. The issue allows an authenticated remote attacker to achieve code execution inside deployment containers via unsafe interpolation in health check configuration handling.
A GitHub commit in the coollabsio/coolify repository introduced validation for user-supplied CMD health check commands, corrected shell escaping in generated curl commands, and added a security-focused unit test to prevent OS command injection.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers have identified and disclosed a series of critical vulnerabilities in *Coolify*, an open-source self-hosting platform used for managing servers, applications, and databases. The flaws, affecting versions up to and including v4.0.0-beta.434, include multiple command injection vulnerabilities (such as CVE-2025-66209, CVE-2025-66210, CVE-2025-66211, CVE-2025-66212, CVE-2025-66213, CVE-2025-64419, CVE-2025-64424, CVE-2025-59156, and CVE-2025-59157) that allow authenticated users with varying levels of privilege to execute arbitrary commands as root on the host server. Additional issues include a privilege escalation flaw (CVE-2025-64421) enabling low-privileged users to grant themselves admin access, an information disclosure vulnerability (CVE-2025-64420) exposing the root user's private SSH key, a host header injection in the password reset workflow (CVE-2025-64425), and a stored XSS vulnerability (CVE-2025-59158) in project names. Several of these vulnerabilities have CVSS scores of 9.4 or higher, indicating critical risk, and many allow for remote exploitation by authenticated users. Exploitation of these vulnerabilities could result in full server compromise, unauthorized root access, account takeover, and execution of arbitrary code on affected Coolify instances. Some vulnerabilities have been patched in later beta versions (e.g., 4.0.0-beta.420.7 and 4.0.0-beta.445), but for others, it is unclear if a fix is available at the time of disclosure. Organizations using self-hosted Coolify should urgently review their deployments, apply available patches, and audit user permissions to mitigate the risk of exploitation. The breadth and severity of these flaws highlight the importance of prompt vulnerability management and monitoring for unauthorized activity on Coolify-managed infrastructure.
Jun 30, 2026
Splunk disclosed a critical vulnerability in **Splunk AI Toolkit** that allows OS command injection through the `btool` Configuration Helper, affecting versions earlier than **5.7.4**. Tracked as **`CVE-2026-20266`** and rated **CVSS 9.1**, the flaw stems from unsafe shell execution that can let a user with the Splunk **admin** role run arbitrary commands on the host running Splunk Enterprise, creating a direct path to host compromise. Splunk also fixed **`CVE-2026-20265`**, a lower-severity insecure default domain allowlist issue rated **CVSS 4.3** that could allow a low-privileged user to trigger outbound HTTP requests and potentially exfiltrate data to an attacker-controlled server. The Canadian Centre for Cyber Security highlighted the vendor advisory in **AV26-614** and urged administrators to review Splunk’s guidance and upgrade to **version 5.7.4 or later**; public reporting said there was **no confirmed exploitation in the wild** at disclosure time.
Jul 12, 2026
Dokploy disclosed and patched **CVE-2026-72878**, an OS command injection vulnerability in its backup and restore pipeline that allows an authenticated admin or owner to execute arbitrary commands on the host running the self-hosted PaaS. The flaw affects versions prior to `0.29.13` and arises from user-controlled database fields being interpolated directly into `bash` and `sh` command strings executed through `child_process.exec()`, giving attackers a path to host-level code execution rather than confinement inside application containers. The remediation in Dokploy `0.29.13` hardens multiple backup and restore paths by escaping shell arguments with the `shell-quote` library. The patch replaces unsafe interpolation across workflows involving `rclone`, `gunzip`, `unzip`, and restore operations for Compose, LibSQL, MariaDB, MongoDB, MySQL, PostgreSQL, and web server backups, while also protecting S3-related parameters including bucket paths, backup filenames, temporary directories, access keys, secret keys, region, endpoint, and provider.
Aug 11, 2026