CVE-2026-34049: Coollabsio Coolify

Low severity, CVSS 3.3. EPSS: 0.3% chance of exploitation in the next 30 days.

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. From 4.0.0-beta.451 through 4.0.0-beta.470, database backup handling for MongoDB collection names did not fully validate shell metacharacters, allowing a highly privileged attacker who can configure backup inputs to inject commands. This issue is fixed in version 4.0.0-beta.471.

Affected products

• Coollabsio Coolify: from 4.0.0-beta.451, before 4.0.0-beta.471 (fixed in 4.0.0-beta.471)

Published 2026-07-06. Last modified 2026-07-07.