Description

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. In Coolify versions prior to and including v4.0.0-beta.434, low privileged users are able to see the private key of the root user on the Coolify instance. This allows them to ssh to the server and authenticate as root user, using the private key. As of time of publication, it is unclear if a patch is available.

INFO

Published Date :

2026-01-05T19:20:24.392Z

Last Modified :

2026-01-05T19:30:10.050Z

Source :

GitHub_M
AFFECTED PRODUCTS

The following products are affected by CVE-2025-64420 vulnerability.

Vendors Products
Coollabs
  • Coolify
Coollabsio
  • Coolify
REFERENCES

Here, you will find a curated list of external links that provide in-depth information to CVE-2025-64420.

URL Resource
https://github.com/coollabsio/coolify/security/advisories/GHSA-qwxj-qch7-whpc cve-icon cve-icon
Login to claim this CVE

CVSS Vulnerability Scoring System

Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact