Coolify CVE Overview 2025/2026: Critical Vulnerabilities and Urgent Update Required

Running Coolify and need help with secure operations or updates? WZ-IT offers Coolify installation, maintenance, and security hardening. Schedule a free initial call: Book appointment.

Update of 12 October 2026: After this post, Coolify published more than 40 further security advisories in June and July 2026, several of them rated CVSS 9.9 (e.g. CVE-2026-34048 and CVE-2026-34047: missing authorization on the terminal WebSocket, command execution by members) as well as CVE-2026-34049, an incomplete fix for CVE-2025-66209. The fixes are included up to 4.0.0-beta.474. On April 27, 2026, v4.0.0 became the first stable release; the current release is v4.4.6 (October 9, 2026). Version 4.0.0-beta.451 is therefore no longer sufficient. Coolify has no entry in the CISA Known Exploited Vulnerabilities catalog.

Correction of 12 October 2026: The number of exposed instances now follows the Censys advisory (52,650 hosts); the previously stated country breakdown has been removed because it cannot be verified from a primary source. The affected range of CVE-2025-59955 has been corrected to the GitHub advisory (up to 4.0.0-beta.428), and the CVSS details now name version and assessor.

Coolify is a popular self-hosted PaaS platform and alternative to Heroku, Netlify, or Vercel. The platform orchestrates deployments and server automation – which is exactly what makes the current security vulnerabilities so critical: Coolify inherently performs privileged operations, often with root privileges on the host system.

According to the Censys advisory of January 6, 2026, 52,650 Coolify hosts were publicly accessible worldwide.

No active attacks have been observed so far. Given the severity of the vulnerabilities – CVSS scores of up to 9.9 – an immediate update to at least version 4.0.0-beta.451 was strongly recommended at the time of publication. As of October 2026, the target is the current stable release v4.4.6 (see the update note above).

Table of Contents

• Critical: RCE & Command Injection
• Account Takeover & Privilege Escalation
• Information Disclosure / Secret Leakage
• Client-Side: Stored XSS
• Older Relevant CVEs (2025)
• Affected Versions Overview
• Typical Attack Chains
• Hardening and Mitigation Recommendations
• Our Approach at WZ-IT

Critical: RCE & Command Injection

These CVEs are particularly critical because user input ends up unsanitized in shell commands – resulting in Remote Code Execution up to root.

Core Problem: Multiple independent code paths (DB backup/import, proxy configuration, storage mounts, Git fields, Compose) implement the "User Input → Shell" pattern without sufficient validation.

Account Takeover & Privilege Escalation

These CVEs are particularly relevant for multi-user setups or when inviting users you don't fully trust.

Information Disclosure / Secret Leakage

Client-Side: Stored XSS

Older Relevant CVEs (2025)

These CVEs are not the most recent but target the same fundamental class: missing authorization for sensitive operations.

Affected Versions Overview

Typical Attack Chains

Without detailing exploits, attacks typically follow this pattern:

1. Initial Access: Attacker gains low-priv access (Member) or exploits auth flow weakness (Invite/Reset/Brute force)
2. Privilege Escalation / RCE: From Member context, achieves root Code Execution via Command Injection or Compose Injection
3. Lateral Movement/Impact: Access to keys/host/SSH → compromise of additional systems

Hardening and Mitigation Recommendations

Patch/Upgrade (Priority 1)

Upgrade to the current stable 4.x release (v4.4.6 as of October 2026) is the most important step. Version 4.0.0-beta.451 already fixed, as of January 2026:

• All 5 critical Command Injection CVEs (66209-66213)
• docker-compose.yaml parameter issue (64419)
• Compose/Git-Repo Injection & Stored XSS (59156/59157/59158)

Defense-in-Depth (for Multi-User Setups)

• Configure RBAC restrictively: Keep member rights minimal; assign App/Service management only to trusted roles
• Secure invitation/reset flows: Strict link handling, host header validation, logging/alerting
• Brute force resilience: Enforce rate limits server-side via reverse proxy/WAF
• Key hygiene: Rotate private keys, minimize root SSH, separate keys per server/team

Network Level

• Don't expose Coolify admin interface publicly
• Restrict access via VPN or IP whitelist
• Set up monitoring for unusual API calls

Our Approach at WZ-IT

At WZ-IT, we help organizations run Coolify securely:

• Security Audit: Review of your existing Coolify installation for known vulnerabilities
• Managed Updates: Regular, tested updates without downtime
• Hardening: RBAC configuration, network segmentation, monitoring
• Installation: Secure new installation with best practices

Learn more about our Coolify services: Coolify Expertise | Installation & Setup

Further Resources

• Coolify: Deploy a Next.js App in 4 Steps – Our introduction guide
• Coolify Expertise at WZ-IT – Overview of our services
• Coolify Installation & Setup – On-Premise, Cloud & Hybrid

Conclusion: Coolify is a powerful tool for self-hosted deployments – but with great power comes great responsibility. The current CVEs demonstrate that consistent patching is essential for orchestration platforms. Update to the current stable 4.x release and review your RBAC configuration.

Need help with updating or security hardening your Coolify instance? Contact us – we're happy to help.

Sources

• Coolify: GitHub Security Advisories
• Coolify: Releases
• NVD: CVE-2025-66209
• NVD: CVE-2025-66212
• GitHub: GHSA-927g-56xp-6427 (CVE-2025-59955)
• Censys: Advisory CVE-2025-64424, CVE-2025-64420, CVE-2025-64419
• NVD: CVE-2026-34048