Coolify Discloses 11 Critical Flaws Enabling Full Server Compromise on Self-Hosted Instances

Cybersecurity researchers have disclosed 11 critical flaws in Coolify, a self-hosted, open‑source platform, that could lead to authentication bypass and remote code execution, potentially allowing full server compromise on affected instances.

The vulnerabilities include multiple authenticated and unauthenticated command‑injection flaws across database backup, import, PostgreSQL init script management, Dynamic Proxy Configuration, File Storage Directory Mount, and git source input fields, with CVSS scores up to 10.0; additional issues include high‑severity OS command injections and a stored XSS risk. The article notes the affected versions, detailing fixes in newer beta releases and that some fixes are still unspecified for certain CVEs.

Source data from Censys indicates there are about 52,890 exposed Coolify hosts as of 8 January 2026, with the majority in Germany (15,000), the U.S. (9,800), France (8,000), Brazil (4,200) and Finland (3,400). While there are no indications of wild exploitation, users are urged to apply fixes promptly given the severity of the flaws.