CVE-2025-22612
Critical
Description
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.374, the missing authorization allows an authenticated user to retrieve any existing private keys on a coolify instance in plain text. If the server configuration of IP / domain, port (most likely 22) and user (root) matches with the victim's server configuration, then the attacker can execute arbitrary commands on the remote server. Version 4.0.0-beta.374 fixes the issue.
SeverityCritical
CVSS10.0
Exploit probability—
ProductCoollabs Coolify
PublishedJan 24, 2025
First seenJan 24, 2025
How to fix
Update
- coollabs coolify4.0.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| coollabs coolify | v < 4.0.0, 4.0.0 | 4.0.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.