CVE-2026-34149

{
  "id": "CVE-2026-34149",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-07T04:17:49.800",
  "lastModified": "2026-10-25T20:10:00.147",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, DatabaseBackupJob interpolates user-controlled database credentials and MongoDB collection exclusion names into backup shell commands without adequate escaping, allowing an authenticated user with database management permissions to execute commands on managed servers. This issue is fixed in version 4.0.0-beta.471."
    },
    {
      "lang": "es",
      "value": "Coolify es una herramienta de código abierto y autoalojable para gestionar servidores, aplicaciones y bases de datos. Antes de 4.0.0-beta.471, DatabaseBackupJob interpola credenciales de base de datos controladas por el usuario y nombres de exclusión de colecciones de MongoDB en comandos de shell de copia de seguridad sin un escape adecuado, lo que permite a un usuario autenticado con permisos de gestión de bases de datos ejecutar comandos en los servidores gestionados. Este problema está solucionado en la versión 4.0.0-beta.471."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "coollabsio",
          "product": "coolify",
          "versions": [
            {
              "version": "< 4.0.0-beta.471",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N",
          "baseScore": 3.3,
          "baseSeverity": "LOW",
          "attackVector": "NETWORK",
          "attackComplexity": "HIGH",
          "privilegesRequired": "HIGH",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 0.7,
        "impactScore": 2.5
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-07T14:06:56.986425Z",
          "id": "CVE-2026-34149",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-78"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/coollabsio/coolify/commit/952f3247970d261ff93f85c79066192f58f9557e",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/coollabsio/coolify/commit/99043600ee881fd8581185e7590604d9882382cd",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.471",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/coollabsio/coolify/security/advisories/GHSA-4vff-6j8j-qhcg",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/coollabsio/coolify/security/advisories/GHSA-4vff-6j8j-qhcg",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ]
}