CVE-2026-34149: Coolify DatabaseBackupJob Command Injection Vulnerability

Technical summary

CVE-2026-34149 is a command injection vulnerability in Coolify's DatabaseBackupJob component. The vulnerability stems from unsafe string interpolation of user-supplied database credentials and MongoDB collection exclusion parameters into shell command strings. Insufficient input sanitization and output escaping allow authenticated users holding database management roles to break out of the intended command context and inject arbitrary shell metacharacters and commands. The attack vector is network-based, requires high privilege (database admin role) and high complexity (crafting specific payloads), and results in limited confidentiality and integrity impact. The underlying weakness is classified as CWE-78 (OS Command Injection).

Business impact

The risk is constrained by the authentication and privilege requirements—an attacker must already have valid Coolify credentials and database management permissions. However, for organizations running Coolify in environments where database admins are less trusted or where credentials are shared broadly, this creates a lateral movement and privilege escalation risk. A malicious database admin could gain shell access to any server managed by that Coolify instance, potentially leading to data exfiltration, service disruption, or further network compromise. The low CVSS score reflects these mitigating factors, but organizations should evaluate their own access control posture and trust model.

Affected systems

Coolify versions prior to 4.0.0-beta.471 are affected. The vulnerability is present in the DatabaseBackupJob functionality, so it is only exploitable by users who can create or modify backup jobs. Self-hosted Coolify instances are the primary target. No vendor-managed SaaS instances of Coolify are known to be affected in the same way, as they would control access and updates centrally.

Exploitability

Exploitation requires valid Coolify authentication and database management permissions—a relatively high bar. The attacker must also understand shell command syntax and the specific backup job configuration interface well enough to inject payloads through credential or exclusion name fields. No public exploit code or proof-of-concept has been disclosed. The complexity of crafting a payload and the need for elevated privileges mean opportunistic attacks are unlikely, but targeted attacks by a disgruntled database administrator or an attacker who has compromised a privileged account are realistic.

Remediation

Update Coolify to version 4.0.0-beta.471 or later. The fix includes proper escaping of user-supplied input before interpolation into shell commands. Organizations unable to upgrade immediately should restrict database management permissions to trusted personnel only and monitor backup job configurations for suspicious credential or exclusion patterns.

Patch guidance

Verify your Coolify version by checking the application dashboard or release notes. If running a version prior to 4.0.0-beta.471, download and apply the latest stable or beta release from the official Coolify repository. Test the update in a staging environment first to confirm backup jobs continue to function correctly. Review any existing backup job configurations after patching to ensure they remain valid and functional.

Detection guidance

Monitor Coolify audit logs for database backup job creation or modification events, especially any that include unusual characters (backticks, dollar signs, pipes, semicolons) in credential fields or collection exclusion parameters. Check server access logs on managed systems for unexpected command execution or shell access initiated from Coolify processes during backup windows. If you suspect exploitation, review the shell command history on affected servers and inspect database backup logs for abnormal activity or failed backup attempts that may indicate tampering.

Why prioritize this

This vulnerability warrants prompt but not emergency attention. The CVSS score of 3.3 (Low) accurately reflects the dual requirement for authentication and elevated privileges. However, it should be prioritized above lower-severity issues because exploitation could grant shell access to critical infrastructure. Organizations with strict access controls and a small number of trusted database administrators may deprioritize this slightly; those with broader database admin roles or shared credentials should treat it as medium priority.

Risk score, explained

The CVSS 3.1 score of 3.3 reflects: Network attack vector (AV:N) — exploitable remotely; High attack complexity (AC:H) — requires crafted payloads and understanding of the interface; High privilege requirement (PR:H) — database management role required; No user interaction needed (UI:N); Unchanged scope (S:U); and Low impact to confidentiality and integrity (C:L, I:L) with no availability impact (A:N). The high privilege and complexity requirements suppress the score despite the serious nature of remote code execution.

Frequently asked questions