SEPTEMBER 17, 2026
Live Feed
Back to database
Case File

CVE-2026-34149

LOW · CVSS 3.3 EPSS 0.22% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-07-07 · Last synced 2026-08-06

CyberRota Analysis

AI-Generated

MongoDB versions prior to 4.0.0-beta.471 are vulnerable due to inadequate escaping of user-controlled database credentials and collection exclusion names in the DatabaseBackupJob, which allows authenticated users with database management permissions to execute arbitrary commands on managed servers. While the severity is rated low, organizations using Coolify for database management should prioritize upgrading to the fixed version to mitigate potential command injection risks.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

GitHub PoC Links
github.com ↗ github.com ↗ github.com ↗ github.com ↗

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-34149
Severity
LOW
CVSS
3.3
EPSS
0.22%
MongoDB

Original NVD Description

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, DatabaseBackupJob interpolates user-controlled database credentials and MongoDB collection exclusion names into backup shell commands without adequate escaping, allowing an authenticated user with database management permissions to execute commands on managed servers. This issue is fixed in version 4.0.0-beta.471.