Dashboard / CVE-2026-34149

CVE-2026-34149

LOW
INFO Priority: 0.01 BB Relevance: 42/100
Published: 2026-07-07 Modified: 2026-10-25 First seen: 2026-10-29 Status: active

Attack Surface

Network No Interaction

CVSS Vector Breakdown

AV: Network
AC: High
PR: High
UI: None
S: Unchanged
C: Low
I: Low
A: None

Description

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, DatabaseBackupJob interpolates user-controlled database credentials and MongoDB collection exclusion names into backup shell commands without adequate escaping, allowing an authenticated user with database management permissions to execute commands on managed servers. This issue is fixed in version 4.0.0-beta.471.

Weakness Classification (1)

References & Advisories (4)

Bug Bounty Relevance

42 / 100
✓ Network accessible
✓ No user interaction

CVSS Score

3.3 / 10.0 v3.1
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N

EPSS — Exploitation Probability

0.27%
Raw Score 0.002720
Percentile 19.5%
Date 2026-10-29

EPSS Trend

2026-10-29
0.00272
2026-10-28
0.00272

Intelligence Sources

nvd ref →

External Links