CVE-2025-59156 Coollabs CVE debrief

Who should care

System administrators, DevOps teams, and security personnel responsible for managing servers, applications, and databases using Coolify should assess their exposure and take necessary actions to mitigate the vulnerability.

Why it matters

Defenders should prioritize updating to version 4.0.0-beta.420.7 or later and restrict project creation and update permissions to trusted members to mitigate the vulnerability.

• Potential root-level command execution on the host OS
• Bypassing of container isolation
• Arbitrary Docker Compose directive injection
• Elevation of privileges for low-privileged members

Technical summary

Coolify, an open-source tool for managing servers, applications, and databases, is vulnerable to a Remote Code Execution (RCE) attack prior to version 4.0.0-beta.420.7. The vulnerability exists in the application's deployment workflow, allowing a low-privileged member to inject arbitrary Docker Compose directives during project creation or updates. This flaw can lead to root-level command execution on the host OS by bypassing container isolation. Defenders should prioritize updating to version 4.0.0-beta.420.7 or later and restrict project creation and update permissions to trusted members to mitigate the vulnerability.

Defensive priority

Defenders should prioritize updating to version 4.0.0-beta.420.7 or later and restrict project creation and update permissions to trusted members.

Recommended defensive actions

• Update to Coolify version 4.0.0-beta.420.7 or later
• Restrict project creation and update permissions to trusted members
• Monitor for suspicious project creation or update activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability allows a low-privileged member to inject arbitrary Docker Compose directives, potentially leading to root-level command execution. Version 4.0.0-beta.420.7 contains a patch for the issue.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.