CVE-2026-34049: Coolify MongoDB Backup Command Injection Vulnerability

Technical summary

The vulnerability exists in Coolify's database backup handling logic, specifically in how MongoDB collection names are processed. The application does not adequately filter shell metacharacters (such as backticks, pipes, or semicolons) from collection names before constructing and executing shell commands. An attacker with administrative access to configure backup inputs can craft a malicious collection name containing embedded shell commands. When the backup process executes, these commands run with the privileges of the Coolify process. The issue is classified as OS Command Injection (CWE-78) and is remediated in version 4.0.0-beta.471.

Business impact

The direct impact is limited by the requirement for high-privilege access to configure backups. However, in multi-tenant deployments or environments where backup configuration is delegated to trusted but potentially compromised users, this could lead to unauthorized code execution on the host system. An attacker gaining this foothold could pivot to other infrastructure, access sensitive data stored on the host, or disrupt Coolify's ability to manage critical servers and applications. For organizations relying on Coolify for infrastructure orchestration, this represents a privilege-escalation risk that could undermine the security of all managed systems.

Affected systems

Coolify versions 4.0.0-beta.451 through 4.0.0-beta.470 are affected. The vulnerability is specific to the MongoDB backup feature and only manifests when backup operations are configured and executed. Organizations running older stable releases before the beta cycle, or those already on version 4.0.0-beta.471 or later, are not affected. Verify your installed version in the Coolify admin panel or by checking deployment logs.

Exploitability

Exploitation requires a highly privileged account with explicit permissions to configure database backups—a role typically restricted to administrators. There is no evidence of public exploits or active exploitation in the wild. The attack scenario assumes either a compromised administrator account or a malicious insider with backup configuration rights. The complexity is high because the attacker must understand Coolify's backup interface and craft a payload that will be injected into a valid shell command context. The risk is substantially lower than vulnerabilities exploitable by low-privilege or unauthenticated attackers.

Remediation

Update Coolify to version 4.0.0-beta.471 or later, where shell metacharacter validation has been added to collection name handling. Before updating, audit which users have backup configuration permissions and verify that those accounts have not been compromised. If you cannot update immediately, restrict backup configuration access to a minimal set of highly trusted administrators and monitor backup execution logs for unexpected command patterns or errors.

Patch guidance

Coolify updates should be applied according to your deployment model. For Docker-based installations, pull the latest image and restart containers. For source-based deployments, update from the repository and rebuild. Version 4.0.0-beta.471 is the minimum secure version; later releases are also safe. Test the update in a non-production environment first to ensure backup functionality is not disrupted. Verify that existing backup jobs complete successfully after patching.

Detection guidance

Review Coolify audit logs for backup configuration changes, particularly any unusual collection names containing shell metacharacters (backticks, pipes, semicolons, dollar signs, parentheses). Monitor system logs on the Coolify host for unexpected child processes spawned during backup operations. Check MongoDB backup output and logs for signs of command injection attempts. If you observe collection names like "test`id`" or "test$(whoami)" in configuration, investigate immediately. Network detection is difficult without inline inspection of Coolify API traffic, but behavioral monitoring of the Coolify process for unexpected system calls can help.

Why prioritize this

Despite the low CVSS score, this vulnerability warrants timely attention because it affects the integrity of an infrastructure management tool. While the privilege requirement is high, the potential blast radius—if exploited—could compromise all systems managed by Coolify. Prioritize patching if you have delegated backup management to non-administrative staff or operate in a multi-tenant environment. For purely single-admin deployments with strong access controls, the risk is minimal but updating to 4.0.0-beta.471 remains a best practice.

Risk score, explained

The CVSS 3.1 score of 3.3 (LOW) reflects the requirement for a highly privileged attacker, no user interaction, and local impact scope. The vulnerability does not affect confidentiality or availability directly—it enables lateral code execution with the same privileges as Coolify itself. The scoring acknowledges that exploitation is contingent on either a compromised admin account or an internal threat, not a remote unauthenticated attack. Organizations with strong access governance should assess their actual risk as lower; those with looser delegation of admin roles may consider it more serious in context.

Frequently asked questions