CVE-2025-22609 Coolify Vulnerable to Private Key Hijacking / Remote Command Execution (RCE)

Critical 10.0 Published 24 Jan 2025 Updated 12 Feb 2025

Authenticated users can hijack private keys to execute arbitrary commands on other users' servers due to missing authorization checks.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2025-22609?

CVE-2025-22609 is a critical missing authorization vulnerability in coollabsio coolify, published on 24 Jan 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.361, the missing authorization allows any authenticated user to attach any existing private key on a coolify instance to his own server. If the server configuration of IP / domain, port (most likely 22) and user (root) matches with the victim's server configuration, then the attacker can use the `Terminal` feature and execute arbitrary commands on the victim's server. Version 4.0.0-beta.361 fixes the issue.

Weakness: CWE-862

Which versions are affected by CVE-2025-22609?

It affects 1 product.

Products include Coollabs Coolify.

How do I fix CVE-2025-22609?

No fix has been published for CVE-2025-22609 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2025-22609 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-22609 exists.

Sources

Also known as GHSA-3w2c-jfr2-9pg9.