CVE-2026-34149: Coolify OS command injection in DatabaseBackupJob

CVE-2026-34149 · Severity: low · CVSS 3.3 · Published 2026-07-07

Coolify is an open-source platform used to manage servers, applications, and databases from a single dashboard. A security flaw in the database backup system allows users with database management permissions to execute unauthorized commands on the managed servers. This could lead to limited unauthorized access or interference with server operations, though it requires high-level user privileges to exploit.

Technologies: Coollabs Coolify. Vendors: Coollabs.

Quick answers

Is CVE-2026-34149 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-34149 being exploited in the wild.
How severe is CVE-2026-34149?
Low severity, with a CVSS score of 3.3, published 7 July 2026.
Which products and versions are affected?
Coollabs Coolify < 4.0.0-beta.471.
Is there a fix for CVE-2026-34149?
A patch was published on 2026-03-25: Fixes committed to repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-34149 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-34149?
Check whether you run Coollabs Coolify at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An OS command injection vulnerability (CWE-78) exists in Coolify's DatabaseBackupJob component. The application fails to properly escape user-provided database credentials (usernames, passwords, and URIs) and MongoDB collection exclusion names before interpolating them into shell commands used for backups. An authenticated attacker with high-level database management permissions can exploit this by providing specially crafted input to execute arbitrary commands on the underlying managed servers. The attack complexity is considered high as it requires specific administrative privileges. The issue has been addressed in version 4.0.0-beta.471 by implementing proper shell escaping using functions like escapeshellarg and adding input validation for collection names.

Affected products

  • coollabsio Coolify < 4.0.0-beta.471

Timeline

  • 2026-03-25: patched: Fixes committed to repository
  • 2026-04-09: advisory: Release v4.0.0-beta.471 published
  • 2026-07-07: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.