CVE-2026-34035 describes an OS command injection vulnerability (CWE-78) in coollabsio's Coolify product. Before version 4.0.0-beta.466, the application interpolated log drain secret and environment variable values directly into shell commands without proper encoding or sanitization. This flaw allows an authenticated user to inject arbitrary OS commands executed on the host system. The vulnerability has a CVSS 3.1 base score of 8.8, indicating high severity with network attack vector, low attack complexity, and requiring privileges but no user interaction. The issue is resolved in version 4.0.0-beta.466.

Successful exploitation allows an authenticated user to execute arbitrary OS commands on the host running Coolify, potentially leading to full system compromise, data loss, or service disruption. Confidentiality, integrity, and availability impacts are all rated high due to the nature of command injection.

Upgrade to Coolify version 4.0.0-beta.466 or later, where this vulnerability is fixed. No other official remediation or temporary workaround is provided. Patch status is not explicitly stated but the fix version is known, so upgrading is the recommended action.