CVE-2026-34167 Coolify: Cross-tenant activity log disclosure via unlocked Livewire property in ActivityMonitor
Authenticated users can read cross-tenant activity logs and sensitive command outputs due to missing authorization checks in the ActivityMonitor component.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-34167?
CVE-2026-34167 is a medium-severity missing authorization vulnerability in coollabsio coolify, published on 6 Jul 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, the ActivityMonitor Livewire component exposes a public $activityId property without Livewire's #[Locked] attribute. It loads activities via Activity::find($this->activityId) with no authorization or team scoping. Activity IDs are auto-incrementing integers. Any authenticated user can enumerate activity records across all teams and read the full command output from remote SSH processes, which may include secrets, configuration files, and infrastructure details. This issue is fixed in version 4.0.0-beta.471.
Weakness: CWE-639
Which versions are affected by CVE-2026-34167?
How do I fix CVE-2026-34167?
No fix has been published for CVE-2026-34167 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-34167 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-34167 exists.
Sources
Also known as GHSA-962v-gxmw-56hc.