PT-2026-1327 · Coolify · Coolify

Published 2026-01-05 · Updated 2026-01-12 · CVE-2025-64420

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Coolify versions prior to and including 4.0.0-beta.434

Description Coolify is a self-hostable tool for managing servers, applications, and databases. In affected versions, users with limited privileges can view the private key belonging to the root user of the Coolify instance. This access allows them to connect to the server and authenticate as the root user using the compromised private key.

Recommendations Update to a version later than 4.0.0-beta.434.

Exploit

Fix

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

CVE-2025-64420

GHSA-QWXJ-QCH7-WHPC

Affected Products

Coolify

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/64xxx/CVE-2025-64420.json · Exploit
• https://github.com/coollabsio/coolify/security/advisories/GHSA-qwxj-qch7-whpc · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-64420 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-64420 · Security Note
• https://twitter.com/CCBalert/status/2008999931076391122 · Twitter Post
• https://t.me/CVEtracker/41419 · Telegram Post
• https://twitter.com/CVEnew/status/2008265037606252802 · Twitter Post
• https://twitter.com/ActiveITSolutns/status/2010711515255439850 · Twitter Post