CVE-2025-64420Critical· 9.9▾ MidnightCoolify is an open-source and self-hostable tool for managing servers, applications, and databases. In Coolify versions prior to and including v4.0.0-beta.434, low privileged users are able to see the private key of the root user on the …
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 54.5 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.5%
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. In Coolify versions prior to and including v4.0.0-beta.434, low privileged users are able to see the private key of the root user on the Coolify instance. This allows them to ssh to the server and authenticate as root user, using the private key. As of time of publication, it is unclear if a patch is available.
coolify < 4.0.0coolify = 4.0.0Upgrade past the affected range:
coolify 4.0.0Connected by shared product, vendor, weakness, or advisory.
CVE-2025-64425High· 8.1Coolify is an open-source and self-hostable tool for managing servers, applications, and databases
CVE-2025-64422Medium· 4.3Coolify is an open-source and self-hostable tool for managing servers, applications, and databases
CVE-2025-64423High· 8.8Coolify is an open-source and self-hostable tool for managing servers, applications, and databases
CVE-2025-64424High· 8.8Coolify is an open-source and self-hostable tool for managing servers, applications, and databases
CVE-2025-64421High· 8.0Coolify is an open-source and self-hostable tool for managing servers, applications, and databases
CVE-2025-59955Medium· 5.7Coolify is an open-source and self-hostable tool for managing servers, applications, and databases