Self-Hosters Beware: 3 Critical Coolify Flaws Grant Root Access

Self-hosters are being urged to patch three critical Coolify flaws that could grant root access, with the flaws collectively affecting more than 52,000 exposed instances worldwide, including in Germany and the United States. The vulnerabilities, CVE-2025-64419, CVE-2025-64424 and CVE-2025-64420, enable command injection and information disclosure, allowing attackers to bypass authentication, inject commands and access the platform’s private SSH key.

The first flaw sits in the docker compose build pack parameters, where unsanitised inputs can let an attacker run shell commands with elevated privileges during deployment. The second affects the git source input fields in resource configurations, permitting low-privileged users with member access to inject commands. The third, an information disclosure vulnerability, could let low-privileged users obtain the private SSH key, enabling direct SSH authentication and persistent access.

Administrators are advised to upgrade to versions newer than v4.0.0-beta.445 for the Docker Compose flaw and newer than v4.0.0-beta.434 for the SSH and Git Input flaws; according to GitHub, a video PoC demonstrates “trivial command injection.”