Vulnerability class
Attacker-controlled data reaches a shell (bash -c, exec, SSH) without escaping.
3 write-ups, 3 vulnerabilities
CVE-2026-34049
3.3 · LowThe CVE-2025-66209 fix escaped database names in Coolify backups but not MongoDB collection names, which still reached a root shell on the server.
CVE-2026-45662
8.8 · HighDokploy escaped the registry URL for docker login but not for docker logout, so deleting a crafted registry ran shell commands on the host.
CVE-2026-34940
8.7 · HighA user allowed to create KubeAI Model resources could run shell commands inside model pods by adding metacharacters to the model URL.
| Identifier | Product | Vulnerability | CVSS | Published |
|---|---|---|---|---|
| CVE-2026-34049 | Coolify | Command injection through MongoDB collection names in database backups | 3.3 Low | |
| CVE-2026-45662 | Dokploy | Command injection through registryUrl in docker logout | 8.8 High | |
| CVE-2026-34940 | KubeAI | Command injection through the Model URL in the Ollama startup probe | 8.7 High |
