coolify
- Software type
- Container platform
- Total vulnerabilities (90 days)
- Products & ServicesProducts & Services
- SolutionsSolutions
- PricingPricing
- CompanyCompany
- ResourcesResources
en
en
As of 11/09/2026, coolify recorded 5 security vulnerabilities in the last 90 days, of which 2 are rated High or Critical. None of these vulnerabilities is actively exploited (KEV) according to CISA's catalog. CyStack recommends that organizations and individual users apply patches as soon as possible.
CyStack does not yet have sufficient official-source data to identify the latest version of coolify and determine which vulnerabilities affect that version.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-12815coollabsio coolify Image Name os command injectionCVE-2025-64425Coolify has host header injection in forgot passwordCVE-2025-64424Colify has command injection vulnerability in project git sourceCVE-2025-64423Coolify has a Privilege Escalation - low privileged users can see and use admin invitation linksCVE-2025-64422Rate-limit bypass on login via X-Forwarded-Host header| Vulnerability | Exploitation status | Fix | Published | Severity |
|---|---|---|---|---|
CVE-2026-12815coollabsio coolify Image Name os command injection | Exploitation statusActively exploited | FixNo |
| SeverityMedium |
CVE-2025-64425Coolify has host header injection in forgot password | Exploitation statusActively exploited | FixYes | Published01/05/2026 | SeverityHigh |
|---|
CVE-2025-64424Colify has command injection vulnerability in project git source | Exploitation statusActively exploited | FixYes | Published01/05/2026 | SeverityCritical |
|---|
CVE-2025-64423Coolify has a Privilege Escalation - low privileged users can see and use admin invitation links | Exploitation statusActively exploited | FixYes | Published01/05/2026 | SeverityHigh |
|---|
CVE-2025-64422Rate-limit bypass on login via X-Forwarded-Host header | Exploitation statusNot exploited | FixYes | Published01/05/2026 | SeverityMedium |
|---|
CVE-2025-64421Coolify has a privilege escalation - low privileged user can invite themselves as an admin user | Exploitation statusNot exploited | FixYes | Published01/05/2026 | SeverityHigh |
|---|
CVE-2025-64420Coolify members can see private key of root user | Exploitation statusNot exploited | FixYes | Published01/05/2026 | SeverityCritical |
|---|
CVE-2025-64419Coolify vulnerable to command injection via docker-compose.yaml parameters | Exploitation statusActively exploited | FixNo | Published01/05/2026 | SeverityCritical |
|---|
CVE-2025-59955Coolify leaksensitive information `email_change_code` in `/api/v1/teams/{team_id | current}/members` API endpoint | Exploitation statusActively exploited | FixNo | Published01/05/2026 | SeverityMedium |
|---|
CVE-2025-59158Coolify has Stored XSS in Project Name | Exploitation statusActively exploited | FixNo | Published01/05/2026 | SeverityCritical |
|---|
CVE-2025-59157Coolify has Git Repository RCE | Exploitation statusActively exploited | FixNo | Published01/05/2026 | SeverityCritical |
|---|
CVE-2025-59156Coolify has Docker Compose Injection issue | Exploitation statusActively exploited | FixNo | Published01/05/2026 | SeverityCritical |
|---|
CVE-2025-66213Coolify Vulnerable to Authenticated Remote Code Execution via Command Injection in File Storage Directory Mount Path | Exploitation statusActively exploited | FixNo | Published12/23/2025 | SeverityCritical |
|---|
CVE-2025-66212Coolify Vulnerable to Authenticated Remote Code Execution via Command Injection in Dynamic Proxy Configuration Filename | Exploitation statusActively exploited | FixNo | Published12/23/2025 | SeverityCritical |
|---|
CVE-2025-66211Coolify Vulnerable to Authenticated Remote Code Execution via Command Injection in PostgreSQL Init Script Filename | Exploitation statusActively exploited | FixNo | Published12/23/2025 | SeverityCritical |
|---|
CVE-2025-66210Coolify Vulnerable to Authenticated Remote Code Execution via Command Injection in Database Import | Exploitation statusActively exploited | FixNo | Published12/23/2025 | SeverityCritical |
|---|
CVE-2025-66209Coolify Vulnerable to Authenticated Remote Code Execution via Command Injection in Database Backup | Exploitation statusActively exploited | FixNo | Published12/23/2025 | SeverityCritical |
|---|
CVE-2025-24025Coolify Vulnerable to Reflected XSS on Tag Search | Exploitation statusNot exploited | FixNo | Published01/24/2025 | SeverityLow |
|---|
CVE-2025-22612Coolify Vulnerable to Private Key Enumeration on Onboarding resulting in Remote Command Execution (RCE) | Exploitation statusActively exploited | FixNo | Published01/24/2025 | SeverityCritical |
|---|
CVE-2025-22611Coolify vulnerable to Privilege Escalation resulting in Remote Command Execution (RCE) | Exploitation statusNot exploited | FixNo | Published01/24/2025 | SeverityCritical |
|---|
CVE-2025-22610Coolify Vulnerable to OAuth Secrets Leak | Exploitation statusNot exploited | FixNo | Published01/24/2025 | SeverityMedium |
|---|
CVE-2025-22609Coolify Vulnerable to Private Key Hijacking / Remote Command Execution (RCE) | Exploitation statusActively exploited | FixNo | Published01/24/2025 | SeverityCritical |
|---|
CVE-2025-22608Coolify Vulnerable to Revocation of Arbitrary Team Invitations (DOS) | Exploitation statusActively exploited | FixNo | Published01/24/2025 | SeverityMedium |
|---|
CVE-2025-22607Coolify Vulnerable to GitHub / GitLab OAuth Secrets Leak | Exploitation statusActively exploited | FixNo | Published01/24/2025 | SeverityMedium |
|---|
CVE-2025-22606Coolify Command Injection Vulnerability in Project Name | Exploitation statusActively exploited | FixNo | Published01/24/2025 | SeverityHigh |
|---|
CVE-2025-22605Coolify OS Command Injection Vulnerability in SSH Command Generation | Exploitation statusActively exploited | FixNo | Published01/24/2025 | SeverityHigh |
|---|
76 Results | Page 2 of 2