CVE-2026-34149CWE-78

Coolify: Authenticated Host-Level RCE via Unescaped Database Credentials in Backup Jobs

Low · published July 7, 2026

CVSS v3.1
3.3
EPSS
0%
Percentile
28.3
In the wild
Unconfirmed
What it is

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, DatabaseBackupJob interpolates user-controlled database credentials and MongoDB collection exclusion names into backup shell commands without adequate escaping, allowing an authenticated user with database management permissions to execute commands on managed servers. This issue is fixed in version 4.0.0-beta.471.

The record
Technical detail
CVSS v3.1
3.3 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00358 · 28.3th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2026-07-07T03:09Z
EPSS history
Timeline
  • 07 JUL 03:09Z
    Coolify: Authenticated Host-Level RCE via Unescaped Database Credentials in Backup Jobs
    cvelistv5