CVE-2025-64420: Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. In Coolify versions prior to and including v4.0.0-beta.434…

PriorityP358high8.8CVSS 3.1

AVNACLPRLUINSUCHIHAH

EPSS

0.50%

38.7th percentile

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. In Coolify versions prior to and including v4.0.0-beta.434, low privileged users are able to see the private key of the root user on the Coolify instance. This allows them to ssh to the server and authenticate as root user, using the private key. As of time of publication, it is unclear if a patch is available.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
coollabs	coolify	< 4.0.0	4.0.0
coollabs	coolify	—	—
coollabsio	coolify	<= 4.0.0-beta.434	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.