CVE-2026-34048

CVE-2026-34048 관리자 전용 터미널 부트스트랩 라우트가 로그인 상태만 확인하여, 일반 팀 멤버가 Coolify의 실시간 터미널 백엔드를 조작하고 팀 서버에서 명령을 실행할 수 있었습니다. 소개 이 문제는 Coolify 오픈소스 셀프 호스팅 PaaS를 검토하던 중, 매우 직접적인 보안 질문을 염두에 두고 발견했습니다: 터미널 접근이 실제로 백엔드 신뢰 경계에서 강제되고 있는가, 아니면 UI에서만 제한되는가? 이 경우, 대답은 나빴습니다. Coolify는 팀 관리자와 소유자만 터미널 접근이 가능하도록 의도했지만, 실시간...

CVE-2026-34047

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, terminal WebSocket bootstrap routes did not enforce the expected authorization middleware, allowing an authenticated user to access terminal functionality for resources...

CVE-2026-34048

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, terminal websocket bootstrap routes only check authentication and do not enforce terminal authorization, allowing a low-privileged team member to connect to terminal routes...

CVE-2026-34048

CVE-2026-34048 concerns Coolify prior to 4.0.0-beta.471, where terminal websocket bootstrap routes failed to enforce terminal authorization, only checking authentication. This allowed a low-privileged team member to connect to terminal routes and execute commands on team servers. The issue is fix...

CVE-2026-34048 Coolify: Missing authorization on terminal websocket bootstrap routes allows low-privileged members to execute commands on team servers

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, terminal websocket bootstrap routes only check authentication and do not enforce terminal authorization, allowing a low-privileged team member to connect to terminal routes...

PT-2026-56130

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, terminal WebSocket bootstrap routes did not enforce the expected authorization middleware, allowing an authenticated user to access terminal functionality for resources...