Product by Coollabsio
Coolify
75 known vulnerabilities in Coolify (Coollabsio), 0 of them actively exploited (CISA KEV).
Key figures
75
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
20
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2025-66209 | Coolify Vulnerable to Authenticated Remote Code Execution via Command Injection in Database Backup | 10.0 | |
| Critical | CVE-2026-34038 | Coolify authenticated remote command injection leading to RCE and secret exfiltration | 9.9 | |
| High | CVE-2026-34599 | Coolify: Authenticated Remote Code Execution in GetLogs Livewire Component | 8.8 | |
| Critical | CVE-2025-66213 | Coolify: OS Command Injection | 8.8 | |
| Critical | CVE-2025-66212 | Coolify: OS Command Injection | 8.8 | |
| Critical | CVE-2025-66211 | Coolify: OS Command Injection | 8.8 | |
| Critical | CVE-2025-66210 | Coolify Vulnerable to Authenticated Remote Code Execution via Command Injection in Database Import | 8.8 | |
| Critical | CVE-2025-64424 | Colify has command injection vulnerability in project git source | 8.8 | |
| Critical | CVE-2025-59157 | Coolify has Git Repository RCE | 10.0 | |
| High | CVE-2026-34594 | Coolify: Authenticated Remote Code Execution via Command Injection in Destination Network Management | 8.8 | |
| Medium | CVE-2026-12815 | coollabsio coolify Image Name os command injection | 6.3 | |
| High | CVE-2026-84694 | Coolify before 4.2.0 Remote Code Execution via Environment Variable Key | 8.8 | |
| Critical | CVE-2026-34048 | Coolify: Improper Authorization | 9.9 | |
| Critical | CVE-2026-86117 | Coolify through 4.3.17 OAuth Account Takeover via Unverified Email Matching | 8.1 | |
| Critical | CVE-2025-59156 | Coolify has Docker Compose Injection issue | 8.8 | |
| High | CVE-2026-59734 | Coolify: OS Command Injection in Health Check Configuration Allows Remote Code Execution | 8.8 | |
| High | CVE-2026-27957 | Coolify: Authenticated RCE via command injection in CA certificate management feature | 8.8 | |
| High | CVE-2026-34034 | Coolify: Host RCE via Sentinel token injection | 8.8 | |
| High | CVE-2026-34153 | Coolify LocalFileVolume fs_path command injection enables RCE | 8.8 | |
| Critical | CVE-2026-34047 | Coolify: WebSocket Endpoint Access Control Flaw Leading to Remote Code Execution | 9.9 | |
| High | CVE-2026-42200 | Coolify: PostgreSQL Init Script Path Traversal Leads to Arbitrary File Write and Root RCE | 8.8 | |
| High | CVE-2026-34597 | Coolify: Authenticated Host RCE | 8.8 | |
| High | CVE-2026-34152 | Coolify: Command Injection via Newline in Pre/Post Deployment Commands (Heredoc Transport) | 8.8 | |
| Critical | CVE-2025-64419 | Coolify vulnerable to command injection via docker-compose.yaml parameters | 9.7 | |
| Critical | CVE-2025-22609 | Coolify Vulnerable to Private Key Hijacking / Remote Command Execution (RCE) | 10.0 |
News
- @RISK®: The Consensus Security Vulnerability Alert: Vol. 26, Num. 26sans-atrisk-mail,