CVE-2026-34037: Critical Improper Authorization in Coolify

How to detect it

Detection is challenging because this vulnerability abuses a legitimate feature: cloning resources. Start by identifying every Coolify instance and confirming its exact running version. Then review audit trails, application logs, reverse proxy logs, and team ownership metadata for clone operations where the source resource owner and destination owner do not match expected tenancy rules.

You should also investigate unexpected resource appearances in another team’s destination, unexplained application duplication, or support tickets involving “mystery” cloned resources. Because the published description names the cloneTo() action, detections should focus on workflow events associated with clone operations, especially from standard user accounts rather than central administrators. If your logging is incomplete, assume potential historical blind spots and prioritize upgrading before relying on retrospective detection.

Technical Notes

Because official vendor log syntax was not provided in the source material, defenders should adapt the following patterns to their stack. The goal is to find clone-related operations crossing team boundaries.

Example grep pattern for application or container logs:

grep -RniE 'cloneTo|clone.*destination|ResourceOperations' /var/log /opt/coolify 2>/dev/null

Example Docker log review if Coolify runs in containers:

docker ps --format '{{.Names}}' | grep -i coolify
docker logs --since 30d <coolify-container-name> 2>&1 | grep -iE 'cloneTo|clone|destination|team'

Example reverse proxy search for clone workflow requests:

grep -RniE 'livewire|clone' /var/log/nginx /var/log/apache2 2>/dev/null

Hunt query logic to implement in SIEM:

Find requests or application events where:
- action name contains "clone" or "cloneTo"
- user_id is present
- source_team_id != destination_team_id
- user is not a platform-wide administrator

Generic suspicious log pattern to look for:

user=<id> action=cloneTo source_resource=<id> source_team=<teamA> destination=<id> destination_team=<teamB>

If your current logs do not capture both source and destination ownership, that gap is itself important. Add telemetry after patching so future authorization regressions are easier to detect.

Mitigation and patching

The primary remediation is straightforward: upgrade Coolify to 4.0.0-beta.464 or later. That is the first fixed version explicitly named in the NVD entry. If you manage multiple instances, prioritize any deployment that serves more than one team or contains less-trusted user accounts. In most organizations, this should be treated as an expedited patch rather than a routine maintenance item.

If you cannot patch immediately, your goal is to reduce exploitability by narrowing who can perform clone operations and who can log in. Since the bug requires authentication, temporarily restricting access can materially reduce risk. Consider limiting Coolify access to trusted administrators only, disabling or pausing delegated team usage if operationally feasible, and reviewing role assignments for accounts that do not need resource cloning capabilities. These are temporary controls, not fixes, because the authorization flaw exists in application logic.

Technical Notes

Where exact deployment commands differ, use your local install method. The source material confirms the fixed release version, but not a single canonical upgrade command for every environment. The commands below are examples defenders can adapt based on how they deployed Coolify.

If you deploy Coolify with Docker Compose, pull the fixed release and restart:

docker compose pull
docker compose up -d

If your compose file pins an image tag, update it to v4.0.0-beta.464 or later before restarting. For example:

services:
  coolify:
    image: ghcr.io/coollabsio/coolify:v4.0.0-beta.464

Then apply:

docker compose up -d

If you need to verify the running image version after restart:

docker ps --format 'table {{.Names}}    {{.Image}}' | grep -i coolify

Short-term workaround if immediate upgrade is blocked: - Restrict Coolify login to trusted admins only. - Remove or disable accounts for external collaborators or low-trust users. - Temporarily suspend clone-related workflows if your operations allow it. - Enforce network access restrictions to the Coolify UI through VPN, IP allowlists, or an identity-aware proxy.

In the absence of vendor-published workaround guidance beyond upgrading, defenders should assume no complete safe workaround exists. Compensating controls help reduce exposure but do not correct the flawed authorization path.

References

The most reliable sources for this CVE are the official and primary references already tied to the NVD record. Defenders should prefer these over third-party summaries when validating affected versions, patch status, and remediation steps.

Use the following references for incident response notes, vulnerability management tickets, and change-control evidence:

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-34037
• Official fix commit: https://github.com/coollabsio/coolify/commit/1759a1631cd63271ebf6caa250c6d93440eaa333
• Official patched release: https://github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.464
• Official GitHub security advisory: https://github.com/coollabsio/coolify/security/advisories/GHSA-ggrr-wrvr-x83v
• CISA KEV catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

If some operational detail is still unknown in your environment, the safe assumption is simple: any Coolify version before 4.0.0-beta.464 on a shared instance should be treated as exposed until patched and reviewed.

For further security measures, consider exploring resources on cloud security and understanding buffer overflow vulnerabilities.

This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.