CVE-2026-34149
LowCVSS 3.3Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
Coolify prior to version 4.0.0-beta.471 contains a command injection vulnerability in the DatabaseBackupJob function. An authenticated user with database management permissions can execute arbitrary commands on managed servers by manipulating database credentials or MongoDB collection exclusion names.
Risk Assessment
An attacker can take control of servers managed by Coolify, leading to compromise of confidentiality, integrity, and availability of data and the entire infrastructure.
Recommendation
Immediately update Coolify to version 4.0.0-beta.471 or later, which includes a fix for this vulnerability.
Original NVD description (English source)
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, DatabaseBackupJob interpolates user-controlled database credentials and MongoDB collection exclusion names into backup shell commands without adequate escaping, allowing an authenticated user with database management permissions to execute commands on managed servers. This issue is fixed in version 4.0.0-beta.471.