CVE-2025-64420 | Coolify is an open-source and self-hostable tool for managin… | CVSS 10.0 CRITICAL

Description

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. In Coolify versions prior to and including v4.0.0-beta.434, low privileged users are able to see the private key of the root user on the Coolify instance. This allows them to ssh to the server and authenticate as root user, using the private key. As of time of publication, it is unclear if a patch is available.

Metadata

CVE ID: CVE-2025-64420
State: PUBLISHED
Assigner: GitHub_M
Reserved: 2025-11-03 22:12 UTC
Published: 2026-01-05 19:20 UTC
Last updated: 2026-01-05 19:30 UTC
Primary CWE: CWE-522
CWE-522: Insufficiently Protected Credentials
Vendor / Product: coollabsio / coolify
Sources: cve.org · NVD

Severity & Metrics

10.0 CRITICAL CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

SSVC — CISA Coordinator

Exploitation: none
Automatable: no
Tech. Impact: total

Affected products (1)

Vendor	Product	Platform	Versions
coollabsio	coolify	—	<= 4.0.0-beta.434

Weakness (CWE)

CWE	Source	Description
CWE-522	cna	CWE-522: Insufficiently Protected Credentials

CVSS scores (1)

Score	Severity	Version	Source	Vector
10.0	CRITICAL	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

References (1)

https://github.com/coollabsio/coolify/security/advisories/GHSA-qwxj-qch7-whpc https://github.com/coollabsio/coolify/security/advisories/GHSA-qwxj-qch7-whpc