How many CVEs have patched handle?

11 published CVEs changed handle in coollabsio/coolify, in 30 distinct patches totalling 190 changed lines, between 2026 and 2026.

What is the latest CVE that changed handle?

CVE-2026-59734 (Coolify: OS Command Injection in Health Check Configuration Allows Remote Code Execution), published 2026-07-09, changed lines 319 to 323 of app/Jobs/ApplicationDeploymentJob.php.

How does handle compare to the rest of coollabsio/coolify?

coollabsio/coolify has 43 CVEs with a located fix in total; 11 of them changed handle.

What do the line numbers refer to?

Line numbers are in the fixed version of the file, as the upstream patch left it. A CVE whose fix was backported to several branches is listed once, with the lines from the upstream commit.

handle in coollabsio/coolify: Patched by 11 CVEs

Coolify: OS Command Injection in Health Check Configuration Allows Remote Code Execution

CVE-2026-59734 · app/Jobs/ApplicationDeploymentJob.php · lines 319–323 · +5 −1

High · CVSS 8.8

EPSS 0.8%2026-07-09

Coolify: OS Command Injection in Health Check Configuration Allows Remote Code Execution

CVE-2026-59734 · app/Jobs/StripeProcessJob.php · lines 242–285 · +3 −2 in 2 hunks

High · CVSS 8.8

EPSS 0.8%2026-07-09

Coolify: OS Command Injection in Health Check Configuration Allows Remote Code Execution

CVE-2026-59734 · app/Jobs/ValidateAndInstallServerJob.php · lines 182–184 · +3 −0

High · CVSS 8.8

EPSS 0.8%2026-07-09

Coolify: OS Command Injection in Health Check Configuration Allows Remote Code Execution

CVE-2026-59734 · app/Jobs/VerifyStripeSubscriptionStatusJob.php · lines 85–87 · +3 −6

High · CVSS 8.8

EPSS 0.8%2026-07-09

Coolify: OS Command Injection via Database Credential Fields in Docker Compose Service Commands

CVE-2026-42201 · app/Actions/Database/StartMysql.php · lines 218–219 · +2 −1

Low · CVSS 3.3

EPSS 0.3%2026-07-07

Coolify: OS Command Injection via Persistent Volume Names - Root RCE on Managed Servers

CVE-2026-42143 · app/Actions/Service/DeleteService.php · line 36 · +1 −1

High · CVSS 8.8

EPSS 0.8%2026-07-07

Coolify: Command Injection via Newline in Pre/Post Deployment Commands (Heredoc Transport)

CVE-2026-34152 · app/Jobs/ApplicationDeploymentJob.php · line 321 · +1 −1

High · CVSS 8.8

EPSS 0.7%2026-07-07

Coolify: Authenticated Host-Level RCE via Unescaped Database Credentials in Backup Jobs

CVE-2026-34149 · app/Jobs/DatabaseBackupJob.php · lines 94–470 · +8 −8 in 8 hunks

Low · CVSS 3.3

EPSS 0.4%2026-07-07

Coolify: Host RCE via Sentinel token injection

CVE-2026-34034 · app/Actions/Server/StartSentinel.php · lines 27–56 · +4 −1 in 2 hunks

High · CVSS 8.8

EPSS 0.8%2026-07-07

Coolify: Command injection via unsanitized persistent storage name in docker volume commands

CVE-2026-34168 · app/Actions/Service/DeleteService.php · line 36 · +1 −1

High · CVSS 8.8

EPSS 0.8%2026-07-07

Coolify: Host RCE via Log Drain secret/env command injection

CVE-2026-34035 · app/Actions/Server/StartLogDrain.php · lines 180–204 · +14 −25

High · CVSS 8.8

EPSS 0.6%2026-07-07

Coolify: PostgreSQL Healthcheck Command Injection Allows Root Code Execution in Container

CVE-2026-42153 · app/Actions/Database/StartClickhouse.php · line 54 · +1 −1

High · CVSS 8.8

EPSS 0.7%2026-07-06

Coolify: PostgreSQL Healthcheck Command Injection Allows Root Code Execution in Container

CVE-2026-42153 · app/Actions/Database/StartDragonfly.php · line 110 · +1 −1

High · CVSS 8.8

EPSS 0.7%2026-07-06

Coolify: PostgreSQL Healthcheck Command Injection Allows Root Code Execution in Container

CVE-2026-42153 · app/Actions/Database/StartKeydb.php · lines 112–169 · +2 −2 in 2 hunks

High · CVSS 8.8

EPSS 0.7%2026-07-06

Coolify: PostgreSQL Healthcheck Command Injection Allows Root Code Execution in Container

CVE-2026-42153 · app/Actions/Database/StartMariadb.php · line 178 · +1 −1

High · CVSS 8.8

EPSS 0.7%2026-07-06

Coolify: PostgreSQL Healthcheck Command Injection Allows Root Code Execution in Container

CVE-2026-42153 · app/Actions/Database/StartMysql.php · line 178 · +1 −1

High · CVSS 8.8

EPSS 0.7%2026-07-06

Coolify: PostgreSQL Healthcheck Command Injection Allows Root Code Execution in Container

CVE-2026-42153 · app/Actions/Database/StartPostgresql.php · line 114 · +1 −4

High · CVSS 8.8

EPSS 0.7%2026-07-06

Coolify: PostgreSQL Healthcheck Command Injection Allows Root Code Execution in Container

CVE-2026-42153 · app/Actions/Database/StartRedis.php · line 184 · +1 −1

High · CVSS 8.8

EPSS 0.7%2026-07-06

Coolify read-scoped API tokens can perform state-changing validation operations

CVE-2026-32718 · app/Actions/Docker/GetContainersStatus.php · lines 330–420 · +12 −0 in 2 hunks

Medium · CVSS 6.5

EPSS 0.4%2026-07-06

Coolify read-scoped API tokens can perform state-changing validation operations

CVE-2026-32718 · app/Actions/Server/StartLogDrain.php · lines 180–204 · +14 −25

Medium · CVSS 6.5

EPSS 0.4%2026-07-06

Coolify read-scoped API tokens can perform state-changing validation operations

CVE-2026-32718 · app/Actions/Server/StartSentinel.php · lines 27–56 · +4 −1 in 2 hunks

Medium · CVSS 6.5

EPSS 0.4%2026-07-06

Coolify authenticated remote command injection leading to RCE and secret exfiltration

CVE-2026-34038 · app/Jobs/ApplicationDeploymentJob.php · lines 319–323 · +5 −1

Critical · CVSS 9.9

EPSS 2.5%2026-07-06

Coolify authenticated remote command injection leading to RCE and secret exfiltration

CVE-2026-34038 · app/Jobs/StripeProcessJob.php · lines 242–285 · +3 −2 in 2 hunks

Critical · CVSS 9.9

EPSS 2.5%2026-07-06

Coolify authenticated remote command injection leading to RCE and secret exfiltration

CVE-2026-34038 · app/Jobs/ValidateAndInstallServerJob.php · lines 182–184 · +3 −0

Critical · CVSS 9.9

EPSS 2.5%2026-07-06

Coolify authenticated remote command injection leading to RCE and secret exfiltration

CVE-2026-34038 · app/Jobs/VerifyStripeSubscriptionStatusJob.php · lines 85–87 · +3 −6

Critical · CVSS 9.9

EPSS 2.5%2026-07-06

handle

Overview

CVEs that patched it

Other functions in these files

Other hotspots in the repository

Frequently asked questions

References

Track coollabsio/coolify CVEs