{"id":"CVE-2025-22609","summary":"Coolify Vulnerable to Private Key Hijacking / Remote Command Execution (RCE)","details":"Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.361, the missing authorization allows any authenticated user to attach any existing private key on a coolify instance to his own server. If the server configuration of IP / domain, port (most likely 22) and user (root) matches with the victim's server configuration, then the attacker can use the `Terminal` feature and execute arbitrary commands on the victim's server. Version 4.0.0-beta.361 fixes the issue.","aliases":["GHSA-3w2c-jfr2-9pg9"],"modified":"2026-04-10T05:24:08.342263Z","published":"2025-01-24T16:30:34.465Z","database_specific":{"cwe_ids":["CWE-862"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/22xxx/CVE-2025-22609.json","cna_assigner":"GitHub_M"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/22xxx/CVE-2025-22609.json"},{"type":"ADVISORY","url":"https://github.com/coollabsio/coolify/security/advisories/GHSA-3w2c-jfr2-9pg9"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-22609"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/coollabsio/coolify","events":[{"introduced":"0"},{"fixed":"e7306300b1a80dc89d314eef5ce3f54260a77721"}],"database_specific":{"versions":[{"introduced":"0"},{"fixed":"4.0.0-beta.361"}]}}],"versions":["4.0.0-beta.39","4.0.0-beta.40","v1.0.0","v1.0.1","v1.0.10","v1.0.11","v1.0.12","v1.0.13","v1.0.14","v1.0.15","v1.0.16","v1.0.17","v1.0.18","v1.0.19","v1.0.20","v1.0.21","v1.0.22","v1.0.23","v1.0.24","v1.0.3","v1.0.4","v1.0.5","v1.0.6","v1.0.7","v1.0.8","v1.0.9","v2.0.0","v2.0.10","v2.0.11","v2.0.12","v2.0.13","v2.0.14","v2.0.15","v2.0.16","v2.0.17","v2.0.18","v2.0.19","v2.0.2","v2.0.20","v2.0.21","v2.0.22","v2.0.23","v2.0.24","v2.0.25","v2.0.26","v2.0.27","v2.0.28","v2.0.29","v2.0.3","v2.0.30","v2.0.31","v2.0.32","v2.0.4","v2.0.5","v2.0.6","v2.0.7","v2.0.8","v2.1.0","v2.1.1","v2.2.0","v2.2.3","v2.2.4","v2.2.5","v2.2.6","v2.2.7","v2.3.0","v2.3.1","v2.3.2","v2.3.3","v2.4.0","v2.4.1","v2.4.10","v2.4.11","v2.4.2","v2.4.4","v2.4.5","v2.4.6","v2.4.7","v2.4.8","v2.4.9","v2.5.0","v2.5.1","v2.5.2","v2.6.0","v2.6.1","v2.6.2","v2.6.3","v2.7.0","v2.8.0","v2.8.1","v2.8.2","v2.9.0","v2.9.1","v2.9.10","v2.9.11","v2.9.2","v2.9.3","v2.9.4","v2.9.5","v2.9.6","v2.9.7","v2.9.8","v2.9.9","v3.0.0","v3.0.1","v3.0.2","v3.0.3","v3.1.0","v3.1.1","v3.1.2","v3.1.3","v3.1.4","v3.10.0","v3.10.1","v3.10.10","v3.10.11","v3.10.12","v3.10.13","v3.10.14","v3.10.15","v3.10.16","v3.10.2","v3.10.3","v3.10.4","v3.10.5","v3.10.6","v3.10.7","v3.10.8","v3.10.9","v3.11.0","v3.11.1","v3.11.10","v3.11.11","v3.11.12","v3.11.13","v3.11.2","v3.11.3","v3.11.4","v3.11.5","v3.11.6","v3.11.7","v3.11.8","v3.11.9","v3.12.0","v3.12.1","v3.12.10","v3.12.11","v3.12.12","v3.12.13","v3.12.14","v3.12.15","v3.12.16","v3.12.17","v3.12.18","v3.12.19","v3.12.2","v3.12.20","v3.12.21","v3.12.22","v3.12.23","v3.12.24","v3.12.25","v3.12.26","v3.12.27","v3.12.28","v3.12.3","v3.12.4","v3.12.5","v3.12.6","v3.12.7","v3.12.8","v3.12.9","v3.2.0","v3.2.1","v3.2.2","v3.2.3","v3.3.0","v3.3.1","v3.3.2","v3.3.3","v3.3.4","v3.4.0","v3.5.0","v3.5.1","v3.5.2","v3.6.0","v3.7.0","v3.8.0","v3.8.1","v3.8.2","v3.8.3","v3.8.4","v3.8.5","v3.8.6","v3.8.7","v3.8.8","v3.8.9","v3.9.0","v3.9.1","v3.9.2","v3.9.3","v3.9.4","v4.0.0-beta.100","v4.0.0-beta.101","v4.0.0-beta.102","v4.0.0-beta.103","v4.0.0-beta.104","v4.0.0-beta.105","v4.0.0-beta.106","v4.0.0-beta.107","v4.0.0-beta.108","v4.0.0-beta.109","v4.0.0-beta.110","v4.0.0-beta.111","v4.0.0-beta.112","v4.0.0-beta.113","v4.0.0-beta.114","v4.0.0-beta.115","v4.0.0-beta.116","v4.0.0-beta.117","v4.0.0-beta.118","v4.0.0-beta.119","v4.0.0-beta.120","v4.0.0-beta.121","v4.0.0-beta.122","v4.0.0-beta.123","v4.0.0-beta.124","v4.0.0-beta.125","v4.0.0-beta.126","v4.0.0-beta.127","v4.0.0-beta.128","v4.0.0-beta.129","v4.0.0-beta.130","v4.0.0-beta.131","v4.0.0-beta.132","v4.0.0-beta.133","v4.0.0-beta.134","v4.0.0-beta.135","v4.0.0-beta.136","v4.0.0-beta.137","v4.0.0-beta.138","v4.0.0-beta.139","v4.0.0-beta.140","v4.0.0-beta.141","v4.0.0-beta.142","v4.0.0-beta.143","v4.0.0-beta.144","v4.0.0-beta.145","v4.0.0-beta.146","v4.0.0-beta.147","v4.0.0-beta.148","v4.0.0-beta.149","v4.0.0-beta.150","v4.0.0-beta.151","v4.0.0-beta.152","v4.0.0-beta.153","v4.0.0-beta.154","v4.0.0-beta.155","v4.0.0-beta.156","v4.0.0-beta.157","v4.0.0-beta.158","v4.0.0-beta.159","v4.0.0-beta.160","v4.0.0-beta.161","v4.0.0-beta.162","v4.0.0-beta.163","v4.0.0-beta.164","v4.0.0-beta.165","v4.0.0-beta.166","v4.0.0-beta.167","v4.0.0-beta.168","v4.0.0-beta.169","v4.0.0-beta.170","v4.0.0-beta.171","v4.0.0-beta.172","v4.0.0-beta.173","v4.0.0-beta.174","v4.0.0-beta.175","v4.0.0-beta.176","v4.0.0-beta.177","v4.0.0-beta.178","v4.0.0-beta.179","v4.0.0-beta.18","v4.0.0-beta.180","v4.0.0-beta.181","v4.0.0-beta.182","v4.0.0-beta.183","v4.0.0-beta.184","v4.0.0-beta.185","v4.0.0-beta.186","v4.0.0-beta.187","v4.0.0-beta.188","v4.0.0-beta.189","v4.0.0-beta.19","v4.0.0-beta.190","v4.0.0-beta.191","v4.0.0-beta.192","v4.0.0-beta.193","v4.0.0-beta.194","v4.0.0-beta.195","v4.0.0-beta.196","v4.0.0-beta.197","v4.0.0-beta.198","v4.0.0-beta.199","v4.0.0-beta.20","v4.0.0-beta.200","v4.0.0-beta.201","v4.0.0-beta.202","v4.0.0-beta.203","v4.0.0-beta.204","v4.0.0-beta.205","v4.0.0-beta.206","v4.0.0-beta.207","v4.0.0-beta.208","v4.0.0-beta.209","v4.0.0-beta.21","v4.0.0-beta.211","v4.0.0-beta.212","v4.0.0-beta.213","v4.0.0-beta.214","v4.0.0-beta.215","v4.0.0-beta.216","v4.0.0-beta.217","v4.0.0-beta.218","v4.0.0-beta.219","v4.0.0-beta.22","v4.0.0-beta.220","v4.0.0-beta.221","v4.0.0-beta.222","v4.0.0-beta.223","v4.0.0-beta.224","v4.0.0-beta.225","v4.0.0-beta.226","v4.0.0-beta.227","v4.0.0-beta.228","v4.0.0-beta.229","v4.0.0-beta.23","v4.0.0-beta.230","v4.0.0-beta.231","v4.0.0-beta.232","v4.0.0-beta.233","v4.0.0-beta.234","v4.0.0-beta.235","v4.0.0-beta.236","v4.0.0-beta.237","v4.0.0-beta.238","v4.0.0-beta.239","v4.0.0-beta.24","v4.0.0-beta.240","v4.0.0-beta.241","v4.0.0-beta.242","v4.0.0-beta.243","v4.0.0-beta.244","v4.0.0-beta.245","v4.0.0-beta.246","v4.0.0-beta.247","v4.0.0-beta.248","v4.0.0-beta.249","v4.0.0-beta.25","v4.0.0-beta.250","v4.0.0-beta.251","v4.0.0-beta.252","v4.0.0-beta.253","v4.0.0-beta.254","v4.0.0-beta.255","v4.0.0-beta.256","v4.0.0-beta.257","v4.0.0-beta.258","v4.0.0-beta.259","v4.0.0-beta.26","v4.0.0-beta.260","v4.0.0-beta.261","v4.0.0-beta.262","v4.0.0-beta.263","v4.0.0-beta.264","v4.0.0-beta.265","v4.0.0-beta.266","v4.0.0-beta.267","v4.0.0-beta.268","v4.0.0-beta.269","v4.0.0-beta.27","v4.0.0-beta.270","v4.0.0-beta.271","v4.0.0-beta.272","v4.0.0-beta.273","v4.0.0-beta.274","v4.0.0-beta.275","v4.0.0-beta.276","v4.0.0-beta.277","v4.0.0-beta.278","v4.0.0-beta.279","v4.0.0-beta.28","v4.0.0-beta.280","v4.0.0-beta.281","v4.0.0-beta.282","v4.0.0-beta.283","v4.0.0-beta.284","v4.0.0-beta.285","v4.0.0-beta.286","v4.0.0-beta.287","v4.0.0-beta.288","v4.0.0-beta.289","v4.0.0-beta.29","v4.0.0-beta.290","v4.0.0-beta.291","v4.0.0-beta.292","v4.0.0-beta.293","v4.0.0-beta.294","v4.0.0-beta.295","v4.0.0-beta.296","v4.0.0-beta.297","v4.0.0-beta.298","v4.0.0-beta.299","v4.0.0-beta.30","v4.0.0-beta.300","v4.0.0-beta.301","v4.0.0-beta.302","v4.0.0-beta.303","v4.0.0-beta.304","v4.0.0-beta.305","v4.0.0-beta.306","v4.0.0-beta.307","v4.0.0-beta.308","v4.0.0-beta.309","v4.0.0-beta.31","v4.0.0-beta.310","v4.0.0-beta.311","v4.0.0-beta.312","v4.0.0-beta.313","v4.0.0-beta.314","v4.0.0-beta.315","v4.0.0-beta.316","v4.0.0-beta.317","v4.0.0-beta.318","v4.0.0-beta.319","v4.0.0-beta.32","v4.0.0-beta.320","v4.0.0-beta.321","v4.0.0-beta.322","v4.0.0-beta.323","v4.0.0-beta.324","v4.0.0-beta.325","v4.0.0-beta.326","v4.0.0-beta.327","v4.0.0-beta.328","v4.0.0-beta.329","v4.0.0-beta.33","v4.0.0-beta.330","v4.0.0-beta.331","v4.0.0-beta.332","v4.0.0-beta.333","v4.0.0-beta.334","v4.0.0-beta.335","v4.0.0-beta.336","v4.0.0-beta.337","v4.0.0-beta.338","v4.0.0-beta.339","v4.0.0-beta.34","v4.0.0-beta.340","v4.0.0-beta.341","v4.0.0-beta.342","v4.0.0-beta.343","v4.0.0-beta.344","v4.0.0-beta.345","v4.0.0-beta.346","v4.0.0-beta.347","v4.0.0-beta.348","v4.0.0-beta.349","v4.0.0-beta.35","v4.0.0-beta.350","v4.0.0-beta.351","v4.0.0-beta.352","v4.0.0-beta.353","v4.0.0-beta.354","v4.0.0-beta.355","v4.0.0-beta.356","v4.0.0-beta.357","v4.0.0-beta.358","v4.0.0-beta.359","v4.0.0-beta.36","v4.0.0-beta.360","v4.0.0-beta.37","v4.0.0-beta.38","v4.0.0-beta.41","v4.0.0-beta.42","v4.0.0-beta.43","v4.0.0-beta.44","v4.0.0-beta.45","v4.0.0-beta.46","v4.0.0-beta.47","v4.0.0-beta.48","v4.0.0-beta.49","v4.0.0-beta.50","v4.0.0-beta.51","v4.0.0-beta.52","v4.0.0-beta.53","v4.0.0-beta.54","v4.0.0-beta.55","v4.0.0-beta.56","v4.0.0-beta.57","v4.0.0-beta.58","v4.0.0-beta.59","v4.0.0-beta.60","v4.0.0-beta.61","v4.0.0-beta.62","v4.0.0-beta.63","v4.0.0-beta.64","v4.0.0-beta.65","v4.0.0-beta.66","v4.0.0-beta.67","v4.0.0-beta.68","v4.0.0-beta.69","v4.0.0-beta.70","v4.0.0-beta.71","v4.0.0-beta.72","v4.0.0-beta.73","v4.0.0-beta.74","v4.0.0-beta.75","v4.0.0-beta.76","v4.0.0-beta.77","v4.0.0-beta.78","v4.0.0-beta.79","v4.0.0-beta.80","v4.0.0-beta.81","v4.0.0-beta.82","v4.0.0-beta.83","v4.0.0-beta.84","v4.0.0-beta.85","v4.0.0-beta.86","v4.0.0-beta.87","v4.0.0-beta.88","v4.0.0-beta.89","v4.0.0-beta.90","v4.0.0-beta.91","v4.0.0-beta.92","v4.0.0-beta.93","v4.0.0-beta.94","v4.0.0-beta.95","v4.0.0-beta.96","v4.0.0-beta.97","v4.0.0-beta.98","v4.0.0-beta.99"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-22609.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"}]}