CVE-2025-64420: Coolify Information Disclosure Flaw

CVE-2025-64420 Overview

CVE-2025-64420 is a critical information disclosure vulnerability in Coolify, an open-source and self-hostable tool for managing servers, applications, and databases. This vulnerability allows low-privileged users to access the private key of the root user on the Coolify instance. With this exposed private key, attackers can establish SSH connections to the server and authenticate as the root user, resulting in complete system compromise.

Critical Impact
Low-privileged users can obtain root-level SSH access by exploiting exposed private key credentials, enabling full server takeover with complete control over managed infrastructure.

Affected Products

Coolify versions prior to and including v4.0.0-beta.434

Discovery Timeline

2026-01-05 - CVE CVE-2025-64420 published to NVD
2026-01-08 - Last updated in NVD database

Technical Details for CVE-2025-64420

Vulnerability Analysis

This vulnerability represents a severe insufficiently protected credentials issue (CWE-522). Coolify manages server infrastructure by utilizing SSH key-based authentication to connect to managed servers. The application stores the root user's private SSH key in a location accessible to low-privileged users within the application context.

The vulnerability enables authenticated users with minimal privileges to retrieve the private key material that should be restricted to administrative operations only. Once an attacker obtains this private key, they can bypass all application-level access controls by directly connecting to the underlying server infrastructure via SSH with root-level privileges.

The scope change indicated in this vulnerability means that a successful exploit impacts resources beyond the vulnerable component itself—specifically, the underlying server infrastructure that Coolify manages becomes compromised. This transforms a web application vulnerability into complete infrastructure compromise.

Root Cause

The root cause is improper access control implementation around sensitive credential storage. The application fails to enforce adequate authorization checks when low-privileged users access endpoints or data stores containing the root user's private SSH key. This constitutes insufficiently protected credentials (CWE-522), where sensitive authentication material is stored or transmitted without proper safeguards to prevent unauthorized access.

Attack Vector

The attack is network-based and requires low privileges to exploit. An authenticated attacker with minimal access to a Coolify instance can view or retrieve the root user's private SSH key through the application interface or API. The attacker then uses this private key to establish a direct SSH connection to the managed server, authenticating as root without requiring any additional credentials.

The exploitation path follows this pattern:

Attacker obtains low-privileged access to a Coolify instance
Attacker navigates to or queries the location where private keys are exposed
Attacker extracts the root user's private SSH key
Attacker uses the private key to SSH directly to the managed server as root
Attacker achieves complete server compromise with full administrative privileges

Detection Methods for CVE-2025-64420

Indicators of Compromise

Unexpected SSH connections to managed servers from unauthorized source IPs
API requests or page accesses by low-privileged users to key management or credential storage endpoints
Multiple failed or successful SSH authentication attempts using the root user's key fingerprint from unusual locations
Audit log entries showing low-privileged user accounts accessing sensitive configuration or credential sections

Detection Strategies

Monitor Coolify application logs for unauthorized access attempts to key management functionality
Implement alerts for SSH connections to managed infrastructure from IP addresses outside expected administrative ranges
Review authentication logs for root SSH sessions that don't correlate with authorized administrative activities
Configure file integrity monitoring on SSH key storage locations to detect unauthorized reads

Monitoring Recommendations

Enable comprehensive audit logging for all Coolify user actions, particularly around credential and key management areas
Deploy network monitoring to detect SSH connections originating from unexpected sources to managed infrastructure
Implement SIEM correlation rules to identify low-privileged users accessing high-privilege resources
Set up alerting for any direct root SSH logins to managed servers outside of maintenance windows

How to Mitigate CVE-2025-64420

Immediate Actions Required

Restrict network access to Coolify instances to trusted administrative networks only
Review and rotate all SSH keys used by the Coolify instance, particularly the root user's private key
Audit all low-privileged user accounts and remove unnecessary access
Implement additional network segmentation between Coolify and managed server infrastructure
Monitor for any unauthorized SSH connections using existing key material

Patch Information

As of the publication date, it is unclear if a patch is available for this vulnerability. Organizations should monitor the GitHub Security Advisory for updates on remediation availability. Until a patch is released, apply the workarounds and mitigations described below.

Workarounds

Implement strict network access controls to limit who can access the Coolify web interface
Remove or restrict low-privileged user accounts until a patch becomes available
Consider disabling the Coolify instance if it's not critical until remediation is confirmed
Deploy an additional authentication layer (e.g., VPN or network-level authentication) before Coolify access
Rotate SSH keys on managed infrastructure and implement key-based access controls at the network level

bash

# Configuration example - Restrict SSH access to managed servers
# Add to /etc/ssh/sshd_config on managed servers to limit root access

# Disable direct root login until keys are rotated
PermitRootLogin no

# Restrict SSH to specific trusted IP addresses (adjust as needed)
AllowUsers admin@192.168.1.0/24

# Force key-based authentication only
PasswordAuthentication no
PubkeyAuthentication yes

# After changes, restart SSH service
# systemctl restart sshd