What is the CVSS score of CVE-2026-34049?

CVE-2026-34049 has a CVSS 3.1 base score of 3.3 (Low). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-34049?

Yes, a patch is available for CVE-2026-34049. Update the affected software to the latest version immediately.

Coolify CVE-2026-34049

EUVD-2026-41958 LOW

OS Command Injection (CWE-78)

2026-07-06 GitHub_M

Command Injection Coolify Coollabsio

3.3

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

3.3 LOW

AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N

vuln.today AI

3.3 LOW

Network-accessible admin UI justifies AV:N; exploitation requires admin privilege (PR:H) and specific backup configuration alignment (AC:H); no availability impact observed.

3.1 AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:H/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Patch available

Jul 06, 2026 - 23:01 EUVD

Analysis Generated

Jul 06, 2026 - 22:50 vuln.today

DescriptionCVE.org

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. From 4.0.0-beta.451 through 4.0.0-beta.470, database backup handling for MongoDB collection names did not fully validate shell metacharacters, allowing a highly privileged attacker who can configure backup inputs to inject commands. This issue is fixed in version 4.0.0-beta.471.

AnalysisAI

Command injection in Coolify's MongoDB backup handler (versions 4.0.0-beta.451 through 4.0.0-beta.470) allows a highly privileged attacker who controls backup configuration to inject OS-level shell commands via unsanitized metacharacters in MongoDB collection names. The attack requires an already-administrative account capable of modifying backup inputs, substantially limiting the realistic threat surface. No public exploit has been identified and this vulnerability is not listed in CISA KEV; the vendor released a fix in v4.0.0-beta.471.

Technical ContextAI

Coolify is a self-hostable open-source PaaS platform built by Coollabs that manages servers, applications, and databases through a web interface. The affected component is the MongoDB database backup subsystem, where collection names supplied through the backup configuration UI are interpolated into shell command strings without fully neutralizing special characters such as semicolons, backticks, pipes, or subshell operators. CWE-78 (Improper Neutralization of Special Elements used in an OS Command - 'OS Command Injection') is the root cause class: user-controlled string data reaches an OS-level shell interpreter without sufficient escaping or allowlist validation. The affected CPE is cpe:2.3:a:coollabsio:coolify:*:*:*:*:*:*:*:*, covering the beta release channel from 4.0.0-beta.451 through 4.0.0-beta.470.

RemediationAI

Upgrade to Coolify version 4.0.0-beta.471, which contains the vendor-confirmed fix per the release at https://github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.471. The underlying change is implemented in commit b1de75a7c67ce6aee977bd788b41e61837dbe0b9 via pull request https://github.com/coollabsio/coolify/pull/9168. If immediate upgrade is not feasible, restrict access to the Coolify admin and backup configuration interfaces to the smallest possible set of trusted users, and audit existing MongoDB backup job configurations for collection names containing shell metacharacters (;, |, ` `, $(), &&, ||`). Restricting network access to the Coolify management interface via firewall rules or reverse-proxy IP allowlists reduces the attack surface, though this does not address the underlying injection flaw. Note that any workaround relying on access control still leaves the injection path open for any actor with legitimate admin credentials.