CVE-2025-64420 — AI Deep Analysis Summary

🚨 **Essence**: A critical flaw in Coolify allows low-privilege users to access root user SSH private keys. 📉 **Consequences**: Complete system compromise.…

🛡️ **CWE**: CWE-522 (Insufficiently Protected Credentials). 🔍 **Flaw**: The application fails to restrict access to sensitive cryptographic material.…

📦 **Vendor**: coollabsio. 📦 **Product**: Coolify (Open-source Heroku/Netlify/Vercel alternative). 📅 **Affected Versions**: v4.0.0-beta.434 and all earlier versions. 🚫 Newer versions are likely safe. ✅

🔑 **Privileges**: Escalates from Low-Privilege to **Root**. 📂 **Data**: Exposes Root User SSH Private Keys.…

🔓 **Auth Required**: Yes, but **Low** privilege. 📉 **Threshold**: Low. An attacker only needs basic access to the Coolify interface. 🚶 **Config**: No complex configuration needed. Just valid low-level credentials. ⚡

📜 **Public Exp**: No specific PoC code provided in the data. 🌐 **Status**: Advisory published (GHSA-qwxj-qch7-whpc). 🕵️ **Risk**: High likelihood of wild exploitation due to simplicity (just reading a file/key). ⚠️

🔍 **Check**: Verify your Coolify version. 📋 **Scan**: Look for unauthorized access to SSH key storage endpoints. 🛡️ **Audit**: Check if low-privilege users can retrieve root credentials via API or UI. 🚨

🔧 **Fix**: Upgrade to a version **newer than** v4.0.0-beta.434. 📢 **Source**: Official GitHub Security Advisory (GHSA-qwxj-qch7-whpc). ✅ **Action**: Immediate update recommended by vendor. 🔄

🚧 **Workaround**: Restrict low-privilege user permissions strictly. 🔒 **Mitigation**: Disable SSH key exposure in UI/API if possible. 🛑 **Isolate**: Segregate critical root keys from the application layer. 🧱

🔥 **Priority**: **CRITICAL**. 🚨 **Urgency**: Immediate action required. CVSS Score indicates High impact (C:H, I:H, A:H). 📉 **Risk**: Root compromise is game-over for most servers. 🏃‍♂️