coollabsio coolify
Published Atomicorp research notes for CVEs affecting coollabsio coolify where WAF protections were observed during testing or engineering review.
These notes are not intended to represent the full set of vulnerabilities mitigated by Atomicorp products and should not be interpreted as a coverage matrix, certification list, or census of protected CVEs.
Atomicorp WAF protections are primarily designed around attack techniques and exploit behaviors rather than individual vulnerability identifiers. A published research note documents a positive research finding related to that CVE. If a CVE is absent from these notes, no conclusion should be drawn about protection status.
| CVE | Vulnerability | CVSS | Severity | Rules Observed |
|---|---|---|---|---|
| CVE-2026-34038 | Coolify authenticated remote command injection leading to RCE and secret exfiltration | 9.9 (v3.1) | Critical | 340014 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-34057 | Coolify: Authenticated Remote Code Execution via Command Injection in Database Import Container Name | 8.8 (v3.1) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-34153 | Coolify LocalFileVolume fs_path command injection enables RCE | 8.8 (v3.1) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-34158 | Coolify: Command injection via single-quote breakout in Docker Compose custom commands | 8.8 (v3.1) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-34594 | Coolify: Authenticated Remote Code Execution via Command Injection in Destination Network Management | 8.8 (v3.1) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-34599 | Coolify: Authenticated Remote Code Execution in GetLogs Livewire Component | 8.8 (v3.1) | High | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-42200 | Coolify: PostgreSQL Init Script Path Traversal Leads to Arbitrary File Write and Root RCE | 8.8 (v3.1) | High | 344360 , 390709 |
| CVE-2026-59734 | Coolify: OS Command Injection in Health Check Configuration Allows Remote Code Execution | 8.8 (v3.1) | High | 340014 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-34170 | Coolify: Server-Side Request Forgery via attacker-controlled GitHub App API URL | 4.3 (v3.1) | Medium | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2026-42201 | Coolify: OS Command Injection via Database Credential Fields in Docker Compose Service Commands | 3.3 (v3.1) | Low | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |