CVE-2026-34149 is an OS command injection vulnerability in coollabsio's Coolify product. The issue arises because DatabaseBackupJob interpolates user-controlled database credentials and MongoDB collection exclusion names directly into backup shell commands without proper escaping. This allows an authenticated user with database management permissions to execute arbitrary OS commands on the managed servers. The vulnerability affects versions prior to 4.0.0-beta.471 and is resolved in that version.

An authenticated user with database management permissions can execute arbitrary operating system commands on the managed servers, potentially leading to limited confidentiality and integrity impacts. The CVSS vector indicates network attack vector, high attack complexity, requiring privileges, no user interaction, unchanged scope, and low confidentiality and integrity impact, with no availability impact.

Upgrade to version 4.0.0-beta.471 or later, where the vulnerability is fixed. No other official remediation or temporary fixes are indicated. Patch status is not explicitly confirmed in the advisory, but the description states the issue is fixed in 4.0.0-beta.471, so upgrading to this version or later is the recommended mitigation.