Seven critical security vulnerabilities with the highest rating threaten Coolify

The self-hosting platform Coolify is severely vulnerable. According to security researchers, there are almost 15,000 attackable instances in Germany.

(Image: Black_Kira / Shutterstock.com)

Jan 8, 2026 at 2:36 pm CET

3 min. read

Security

By

Dennis Schirrmacher

Admins of Platform-as-a-Service environments based on Coolify should update their instances promptly. Failure to do so could allow attackers to exploit seven “critical” security vulnerabilities with the highest rating (CVSS score 10 out of 10), among other things, to fully compromise servers.

Scans by security researchers from Censys show that the majority of vulnerable systems are located in Germany. Worldwide, there are over 52,000 instances. In Germany, they found just under 14,800 systems. It is currently unclear whether attacks have already occurred. However, admins should not delay patching for too long.

Attack Vectors

Even though attackers must be authenticated in most cases, the majority of vulnerabilities are classified as “critical” in terms of threat level. If attackers successfully exploit the vulnerabilities, they can, for example, execute malicious code as a root user and thus gain full control over systems (e.g., CVE-2025-64424). In addition, access to private SSH keys that are supposed to be protected is possible (CVE-2025-64420), allowing attackers to gain unauthorized access.

Missing Security Patches

A total of 16 vulnerabilities are known. However, according to entries on GitHub (see end of this message), security updates are currently only available for eight vulnerabilities. It is currently unclear when the developers will fix the remaining vulnerabilities.

Videos by heise

These patches are currently available:

v4.0.0-beta.420.7
>= 4.0.0-beta.451

Admins can find further information on the vulnerable versions and security updates in the linked warning messages. List sorted by threat level in descending order: