CVE-2026-34594: Coolify authenticated command injection in Destination Network Management

Coolify (self-hosted PaaS, Laravel/Livewire application) before 4.0.0-beta.471 contains an authenticated command-injection vulnerability in the Destination Network Management functionality. The network field of a Docker Destination (App\Livewire\Destination\New\Docker and App\Livewire\Destination\Show) was only validated as ['required','string'], so an authenticated user with destination-management permissions could submit a value containing shell metacharacters. That value is stored on the StandaloneDocker / SwarmDocker model and later interpolated unsanitized into shell commands that Coolify executes on the destination's server over SSH (instant_remote_process() → SshMultiplexingHelper::generateSshCommand() → ssh ... 'bash -se' << $delimiter). Because the network string becomes the body of a here-doc fed to bash -se on the remote host, an attacker-controlled network such as x;id > /tmp/pwned # results in arbitrary command execution as root on the Coolify-managed server at the moment the destination is created (the StandaloneDocker::created boot event) and again when it is deleted.

• Package/component affected: coollabsio/coolify — Destination Network Management (app/Livewire/Destination/New/Docker.php, app/Livewire/Destination/Show.php, app/Models/StandaloneDocker.php, app/Models/SwarmDocker.php, and every shell consumer of ->destination->network: ApplicationDeploymentJob, DatabaseBackupJob, StartService, Init command, bootstrap/helpers/proxy.php).
• Affected versions: Coolify < 4.0.0-beta.471 (verified on the official image ghcr.io/coollabsio/coolify:4.0.0-beta.470).
• Risk level: High. Coolify executes SSH commands with the destination server's user (default root). The injected command runs with that privilege on the managed host, enabling full server compromise, access to the Docker socket, lateral movement, and exposure of all managed resources / secrets. Exploitation requires only an authenticated user who can create a destination (the StandaloneDockerPolicy::create check returns true for any authenticated user; createAnyResource likewise returns true).

Impact Parity

• Disclosed/claimed maximum impact: Authenticated command execution ("arbitrary command execution on the Coolify host") via the Destination Network Management network field.
• Reproduced impact from this run: Authenticated command execution as root on the destination server. The injected id command wrote uid=0(root) gid=0(root) groups=0(root) to a marker file on the managed server, proving arbitrary command execution with root privileges through the authenticated web request.
• Parity: full — the claimed authenticated command injection was demonstrated end-to-end against the real product, and the fixed build rejects the same input with no execution.

Root Cause

The network attribute of a Docker Destination is attacker-controlled input that flows into privileged shell commands without validation or escaping.

Vulnerable code path (beta.470):

1. app/Livewire/Destination/New/Docker.php declares the field with only #[Validate(['required','string'])] (no character whitelist), and submit() calls StandaloneDocker::create(['network' => $this->network, ...]).
2. app/Models/StandaloneDocker.php boot() registers a static::created hook that runs:

   instant_remote_process([
       "docker network inspect $newStandaloneDocker->network >/dev/null 2>&1 || docker network create --driver overlay --attachable $newStandaloneDocker->network >/dev/null",
   ], $server, false);
   

   The network is interpolated directly into the command string.
3. instant_remote_process() builds an SSH command via SshMultiplexingHelper::generateSshCommand(), which sends the command as the body of a here-doc to bash -se on the remote server:

   timeout <t> ssh ... 'root'@'<ip>' 'bash -se' << $delimiter
   <command containing the unsanitized network>
   $delimiter
   

   escapedUserAtHost() escapes user@ip, but the command body (the network) is never escaped, so shell metacharacters in network are interpreted by the remote bash. ; breaks out of the docker network inspect token, the attacker command runs, and # comments out the rest of the line. The same unsanitized interpolation exists in Destination/Show.php::delete() and across ApplicationDeploymentJob, DatabaseBackupJob, StartService, Init, and proxy.php.

Fix (PR #9228, released in 4.0.0-beta.471, commit 3d1b9f53a0aec74468be75675bcaaaed0fd41d46; release tag commit 914d7e0b50505bc1fd56c34974fca09ad354e92a):

• Adds DOCKER_NETWORK_PATTERN = '/^[a-zA-Z0-9][a-zA-Z0-9._-]*$/' in app/Support/ValidationPatterns.php and applies it as a regex validation rule on the network field in both Livewire components.
• Adds a setNetworkAttribute() mutator on StandaloneDocker and SwarmDocker that throws InvalidArgumentException for names not matching the pattern.
• Applies escapeshellarg() to every shell usage of the network field.

Reproduction Steps

1. Reference: bundle/repro/reproduction_steps.sh (self-contained).
2. What the script does:
   • Installs the docker compose v2 plugin if missing and pulls the official Coolify images (4.0.0-beta.470 vulnerable, 4.0.0-beta.471 fixed) plus postgres:15-alpine, redis:7-alpine, coolify-testing-host (an SSH-enabled target whose authorized_keys matches a hardcoded key) and coolify-realtime.
   • Brings up the real Coolify stack (Coolify Laravel app + Postgres + Redis + Soketi + the SSH target) on a private Docker network, with IS_WINDOWS_DOCKER_DESKTOP=true so the seeded localhost server targets coolify-testing-host.
   • Bootstraps an authenticated root user, the testing-host SSH private key, and a server pointing at coolify-testing-host (root, port 22).
   • From the coolify-testing-host container, runs an authenticated Python client against the live Coolify web app (http://coolify:8080): logs in via Laravel Fortify, loads /server/{uuid}/destinations, extracts the destination.new.docker Livewire snapshot, and POSTs /livewire/update setting network = "x;id > /tmp/coolify_net_pwned 2>&1 #" and calling submit().
   • Repeats for the fixed image as a negative control.
3. Expected evidence:
   • Vulnerable build: the StandaloneDocker::created event runs the SSH command with the injected network; /tmp/coolify_net_pwned* on the SSH target contains uid=0(root) gid=0(root) groups=0(root), and the Livewire response redirects to the newly created destination.
   • Fixed build: the request is rejected with The network field format is invalid. (regex validation), no destination is created, and no marker file appears.

Evidence

• bundle/logs/reproduction_steps.log — full orchestrated run log.
• bundle/logs/stack_vulnerable.log, bundle/logs/setup_vulnerable.log — vulnerable stack bring-up and bootstrap.
• bundle/logs/vulnerable_attempt_1.log, bundle/logs/vulnerable_attempt_2.log — exploit output for the vulnerable build (Livewire redirect to /destination/<uuid> → destination created).
• bundle/logs/vulnerable_marker_content.txt — captured marker content (uid=0(root) gid=0(root) groups=0(root)).
• bundle/logs/stack_fixed.log, bundle/logs/setup_fixed.log — fixed stack.
• bundle/logs/fixed_attempt_1.log, bundle/logs/fixed_attempt_2.log — exploit output for the fixed build (VALIDATION_BLOCKED + The network field format is invalid., no redirect, no marker).
• bundle/repro/runtime_manifest.json — runtime evidence manifest (entrypoint_kind=api_remote, service_started=true, healthcheck_passed=true, target_path_reached=true).

Key reproduced excerpts (from the interactive verification run):

• Vulnerable: effects redirect=http://coolify:8080/destination/o1jvtyfefdzb8nxnyqv0lkd2; standalone_dockers row with network = x;id > /tmp/coolify_net_pwned 2>&1 # on server_id=1; marker /tmp/coolify_net_pwned = uid=0(root) gid=0(root) groups=0(root).
• Fixed: effects redirect=None, response snippet The network field format is invalid.; no standalone_dockers row with the malicious network; marker file absent.

Environment: official Coolify Docker images on the shared Docker daemon; the authenticated HTTP client runs in the coolify-testing-host container (reaches coolify:8080 over the coolifynet-repro bridge); command execution is performed by Coolify over SSH (bash -se here-doc) from the coolify container to coolify-testing-host as root.

Recommendations / Next Steps

• Upgrade to Coolify >= 4.0.0-beta.471 (PR #9228). The fix combines input validation (regex whitelist matching Docker network naming rules), a model mutator that rejects invalid names, and escapeshellarg() on every shell usage of the network field.
• Defense-in-depth: audit every instant_remote_process() / remote_process() call site for user-controlled interpolation; prefer escapeshellarg() / escapeshellcmd() and validated whitelists for any field that becomes part of an SSH/Docker command string. Consider a shared helper that forbids raw string interpolation of model attributes into command strings.
• Restrict destination-management permissions; do not expose the Coolify admin interface publicly.

Additional Notes

• Idempotency: the script tears the stack down (docker compose down -v + hard cleanup of the fixed container/volume/network names) before each build, and setup.php is idempotent (locates the root user by email, fixes the password hash, ensures a single coolify-testing-host server). Two attempts are run per build with distinct marker paths (hence distinct network strings) to avoid the (server_id, network) unique constraint.
• The Docker daemon in this environment is on a separate host from the script execution sandbox, so published host ports are not reachable from the sandbox; the authenticated client therefore runs inside the coolify-testing-host container and reaches Coolify over the private Docker network (http://coolify:8080). This is a genuine authenticated HTTP request to the running Coolify service; the command execution crosses a real SSH boundary from Coolify to the managed server.
• No sanitizers (ASAN/UBSAN/etc.) are used; this is a real product-mode runtime proof. The negative control (fixed image) demonstrates the patch closes the injection without relying on sanitizer output.