CVE-2026-34049: Coolify MongoDB Backup RCE Vulnerability

CVE-2026-34049 Overview

Coolify is an open-source, self-hostable platform for managing servers, applications, and databases. CVE-2026-34049 is a command injection vulnerability [CWE-78] affecting Coolify versions 4.0.0-beta.451 through 4.0.0-beta.470. The database backup handler for MongoDB collection names failed to validate shell metacharacters. A highly privileged attacker capable of configuring backup inputs can inject arbitrary shell commands into the generated mongodump command line. The issue is fixed in version 4.0.0-beta.471.

Critical Impact
Authenticated attackers with backup configuration privileges can inject shell commands executed by the Coolify backup job, leading to limited confidentiality and integrity impact on the host.

Affected Products

Coolify 4.0.0-beta.451 through 4.0.0-beta.470
MongoDB backup functionality in DatabaseBackupJob
Coolify API endpoint handled by DatabasesController

Discovery Timeline

2026-07-06 - CVE-2026-34049 published to NVD
2026-07-07 - Last updated in NVD database
Fix released in Coolify version 4.0.0-beta.471 via GitHub Pull Request #9168

Technical Details for CVE-2026-34049

Vulnerability Analysis

Coolify constructs mongodump commands by concatenating user-supplied MongoDB collection names into a shell command executed inside a Docker container. The unpatched code path in app/Jobs/DatabaseBackupJob.php builds the command using $collectionsToExclude->implode(' --excludeCollection ') without escaping. An attacker who controls the databases_to_backup input can insert shell metacharacters such as `, $(), ;, or && to break out of the intended argument list. The injected payload runs with the privileges of the Coolify backup process on the host.

Exploitation requires an authenticated user with permission to configure database backups, which limits the practical attack surface. The impact is scoped to command execution in the backup context and does not require user interaction.

Root Cause

The root cause is missing input validation and shell escaping on MongoDB collection names supplied via the backup configuration API. Both the controller entry point and the job that assembles the shell command trusted the input verbatim, violating standard OS command construction guidance for [CWE-78].

Attack Vector

The attack vector is network-based. An authenticated, highly privileged Coolify user submits a crafted databases_to_backup payload through the API handled by DatabasesController. When the backup runs, the malicious collection name is interpolated into the mongodump shell command and executed by the Docker host.

php

// Security patch in app/Jobs/DatabaseBackupJob.php (Coolify PR #9168)
// Before: unescaped collection names concatenated into a shell command
// After: each collection is validated and passed through escapeshellarg()

// Validate and escape each collection name
$escapedCollections = $collectionsToExclude->map(function ($collection) {
    $collection = trim($collection);
    validateShellSafePath($collection, 'collection name');

    return escapeshellarg($collection);
});

if (str($this->database->image)->startsWith('mongo:4')) {
    $commands[] = "docker exec $this->container_name mongodump --uri=$url --gzip --excludeCollection "
        .$escapedCollections->implode(' --excludeCollection ')
        ." --archive > $this->backup_location";
} else {
    $commands[] = "docker exec $this->container_name mongodump --authenticationDatabase=admin --uri=\"$url\" --db $escapedDatabaseName --gzip --excludeCollection "
        .$escapedCollections->implode(' --excludeCollection ')
        ." --archive > $this->backup_location";
}
// Source: https://github.com/coollabsio/coolify/commit/b1de75a7c67ce6aee977bd788b41e61837dbe0b9

Detection Methods for CVE-2026-34049

Indicators of Compromise

Unexpected child processes spawned from the Coolify PHP worker or queue process during backup jobs.
mongodump invocations containing shell metacharacters such as `, $(, ;, |, or && in arguments.
Backup configurations with databases_to_backup values that do not match valid MongoDB collection name syntax.

Detection Strategies

Audit Coolify database backup configuration records for collection names containing non-alphanumeric characters outside [A-Za-z0-9_.-].
Inspect Coolify application logs and queue worker logs for mongodump command strings and compare against expected argument patterns.
Monitor Docker daemon and host process telemetry for unexpected commands executed as children of docker exec targeting Coolify-managed containers.

Monitoring Recommendations

Enable process execution auditing on hosts running Coolify and alert on shell interpreters (sh, bash) launched by the PHP worker.
Forward Coolify queue logs and Laravel exception logs to a central SIEM for review of backup-related failures and validation errors.
Track changes to backup configuration through API access logs, correlating administrative accounts with modifications to databases_to_backup.

How to Mitigate CVE-2026-34049

Immediate Actions Required

Upgrade Coolify to version 4.0.0-beta.471 or later, which introduces validateShellSafePath and escapeshellarg handling for collection names.
Review all existing MongoDB backup configurations and remove entries containing shell metacharacters.
Restrict administrative access to Coolify to trusted operators and enforce strong authentication on the management interface.

Patch Information

The fix is delivered in Coolify 4.0.0-beta.471. See the GitHub Security Advisory GHSA-4mpw-wcj4-v9pp, the patch commit b1de75a, and the release notes for v4.0.0-beta.471. The patch adds validation in DatabasesController and per-collection escaping in DatabaseBackupJob.

Workarounds

Temporarily disable MongoDB backup jobs on affected Coolify instances until the upgrade is applied.
Limit accounts with backup configuration privileges to a minimal set of trusted administrators.
Place Coolify management endpoints behind a VPN or IP allowlist to reduce exposure of the authenticated API surface.

bash

# Upgrade Coolify to the fixed version
curl -fsSL https://cdn.coollabs.io/coolify/install.sh -o install.sh
sudo bash ./install.sh

# Verify installed version is >= 4.0.0-beta.471
docker exec coolify php artisan about | grep -i version