CVE-2026-34049

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. From 4.0.0-beta.451 through 4.0.0-beta.470, database backup handling for MongoDB collection names did not fully validate shell metacharacters, allowing a highly privileged attacker who can configure backup inputs to inject commands. This issue is fixed in version 4.0.0-beta.471.

• CWE-78

• https://github.com/coollabsio/coolify/commit/b1de75a7c67ce6aee977bd788b41e61837dbe0b9
• https://github.com/coollabsio/coolify/pull/9168
• https://github.com/coollabsio/coolify/releases/tag/v4.0.0-beta.471
• https://github.com/coollabsio/coolify/security/advisories/GHSA-4mpw-wcj4-v9pp
• https://github.com/coollabsio/coolify/security/advisories/GHSA-4mpw-wcj4-v9pp

Published

Jul 6, 2026

Last Modified

Jul 7, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-34043Serialize JavaScript to a superset of JSON that includes reg…7.5
• CVE-2026-34044Coolify is an open-source and self-hostable tool for managin…7.7
• CVE-2026-34045Podman Desktop is a graphical tool for developing on contain…9.1
• CVE-2026-34046Langflow is a tool for building and deploying AI-powered age…8.8
• CVE-2026-34047Coolify is an open-source and self-hostable tool for managin…9.9
• CVE-2026-34048Coolify is an open-source and self-hostable tool for managin…9.9
• CVE-2026-3405A vulnerability has been found in thinkgem JeeSite up to 5.1…8.1
• CVE-2026-34050Coolify is an open-source and self-hostable tool for managin…6.5
• CVE-2026-34051OpenEMR is a free and open source electronic health records …5.4
• CVE-2026-34052LTI JupyterHub Authenticator is a JupyterHub authenticator f…5.9
• CVE-2026-34053OpenEMR is a free and open source electronic health records …8.1
• CVE-2026-34054vcpkg is a free and open-source C/C++ package manager. Prior…7.8