Coolify CVE-2025-64420

Requires an existing authenticated low-privilege user account on the target Coolify instance (PR:L). Given such an account, no further user interaction, special protocol, or non-default configuration is documented - the root user's private SSH key is exposed to low-privilege users on affected builds (all releases up to and including v4.0.0-beta.434). The realistic risk is concentrated in multi-user or multi-tenant Coolify deployments where untrusted or lower-trust users are granted accounts; single-operator installations with no additional low-privilege users have effectively no exposed attacker population. Escalation to root additionally requires network reachability of the host's SSH service from the attacker.

The vendor CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8) is credible and well-supported: a low-privileged, already-authenticated Coolify user can read the root user's private SSH key from the instance, which converts a limited application account into full root SSH access on the underlying host - a genuine C:H/I:H/A:H outcome. The exploitation signals, however, temper urgency: EPSS is only 0.05% (16th percentile) and there is no CISA KEV listing, so there is no evidence of active or widespread exploitation. A POC is flagged as publicly available, but the sole reference is the GitHub Security Advisory (GHSA-qwxj-qch7-whpc) itself, which typically documents the flaw rather than shipping turnkey exploit code - treat 'POC available' as weak/advisory-grade rather than a weaponized public exploit. The critical limiting factor is PR:L: the attacker must first hold a valid low-privilege Coolify account, so this is primarily an insider/tenant-escalation and post-compromise risk rather than an internet-wide unauthenticated threat. Net: legitimately high technical impact (application user → host root) but low real-world exploitation pressure today, and gated behind existing authenticated access - a priority for multi-tenant/shared Coolify deployments, lower for single-operator installs.

An organization runs a shared Coolify instance where several developers hold low-privilege accounts. One such user navigates to the area exposing the root user's SSH private key, copies it, and uses it to SSH into the host as root - gaining complete control of the server and every application, database, and secret it manages. A GitHub Security Advisory documents the flaw (weak/advisory-grade POC); no weaponized public exploit is confirmed, and the attacker must already possess a low-privilege account.