CVE-2026-34149: Coolify: Authenticated Host-Level RCE via Unescaped Database Credentials in Backup Jobs
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, DatabaseBackupJob interpolates user-controlled database credentials and MongoDB collection exclusion names into backup shell commands without adequate escaping, allowing an authenticated user with database management permissions to execute commands on managed servers. This issue is fixed in version 4.0.0-beta.471.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Coolifyto a version that resolves this vulnerability.Fixed in 4.0.0-beta.471
Event History
Frequently Asked Questions
What is the severity of CVE-2026-34149?
The severity of CVE-2026-34149 is classified as low with a CVSS score of 3.3.
What type of vulnerability is described in CVE-2026-34149?
CVE-2026-34149 describes an OS Command Injection vulnerability due to unescaped database credentials in backup jobs.
How do I fix CVE-2026-34149?
To fix CVE-2026-34149, upgrade to Coolify version 4.0.0-beta.471 or later where this issue has been addressed.
What impact can CVE-2026-34149 have on my system?
CVE-2026-34149 can potentially allow an authenticated user to execute arbitrary commands on the host system.
What is the affected software for CVE-2026-34149?
The affected software for CVE-2026-34149 is Coolify, specifically versions prior to 4.0.0-beta.471.