What is the CVSS score of CVE-2026-34149?

CVE-2026-34149 has a CVSS 3.1 base score of 3.3 (Low). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-34149?

Yes, a patch is available for CVE-2026-34149. Update the affected software to the latest version immediately.

Coolify CVE-2026-34149

EUVD-2026-41989 LOW

OS Command Injection (CWE-78)

2026-07-07 GitHub_M

Command Injection Coolify Coollabsio

3.3

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

3.3 LOW

AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N

vuln.today AI

9.1 CRITICAL

PR:H for required database management role; S:C with C/I/A:H because arbitrary OS command execution reaches managed servers outside Coolify's own security boundary.

3.1 AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Patch available

Jul 07, 2026 - 05:01 EUVD

Analysis Generated

Jul 07, 2026 - 04:17 vuln.today

DescriptionCVE.org

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, DatabaseBackupJob interpolates user-controlled database credentials and MongoDB collection exclusion names into backup shell commands without adequate escaping, allowing an authenticated user with database management permissions to execute commands on managed servers. This issue is fixed in version 4.0.0-beta.471.

AnalysisAI

Command injection in Coolify's DatabaseBackupJob allows authenticated users holding database management permissions to execute arbitrary OS commands on managed servers by embedding shell metacharacters in database credentials or MongoDB collection exclusion names. All Coolify releases prior to 4.0.0-beta.471 are affected. No public exploit code has been identified at time of analysis and the vulnerability is absent from CISA KEV; however, the practical impact substantially exceeds the official CVSS 3.3 Low rating because successful exploitation grants attacker-controlled shell execution on production infrastructure managed by the platform.

Technical ContextAI

Coolify (CPE: cpe:2.3:a:coollabsio:coolify:*:*:*:*:*:*:*:*) is an open-source, self-hostable PaaS that orchestrates servers, applications, and databases via a web interface. Its DatabaseBackupJob component constructs shell commands to perform database backup operations and directly interpolates user-supplied values - specifically database credentials and MongoDB collection exclusion names - into those commands without sanitization or shell escaping. This is a textbook CWE-78 (Improper Neutralization of Special Elements used in an OS Command) flaw: shell metacharacters present in those inputs (semicolons, backticks, pipe characters, command substitution syntax) are interpreted by the invoking shell rather than treated as literal data. Because Coolify operates as a management plane that issues commands against remote servers, the injection point executes in the context of managed infrastructure rather than solely on the Coolify host itself.

RemediationAI

Upgrade Coolify to version 4.0.0-beta.471 or later, which addresses the injection via commits 952f3247970d261ff93f85c79066192f58f9557e and 99043600ee881fd8581185e7590604d9882382cd as documented at https://github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.471. If an immediate upgrade cannot be performed, restrict database management permissions exclusively to fully trusted administrators, eliminating the attacker role needed for exploitation - note this is a compensating control only and does not fix the underlying flaw. Additionally, audit all database credentials currently stored in Coolify for shell metacharacters (such as ;, |, $(), and backticks) and review recent backup job execution logs on managed servers for anomalous command output. Removing the MongoDB exclusion-name functionality from lower-privileged users is a targeted workaround if the feature is not operationally required.