Coolify Discloses 11 Critical Flaws Enabling Full Server Compromise on Self-Hosted Instances
Summary: Researchers disclosed 11 critical-severity flaws in Coolify, an open-source self-hosting platform, that could enable authentication bypass and remote code execution. Censys counted about 52,890 exposed Coolify hosts as of January 8, 2026, most in Germany (15,000), the U.S. (9,800), France (8,000), Brazil (4,200), and Finland (3,400), with no indications of exploitation in the wild.
What's compelling: Roughly 52,890 Coolify instances sit exposed on the internet, and the flaws allow authentication bypass and remote code execution - full server compromise for anyone who has not yet applied the fixes.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2025-64420CVE-2025-64424
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026