# Coolify 4.5.3 repairs access controls, deployment healthchecks and retry hazards after 4.5 launch Coolify's October 28 v4.5.2 and v4.5.3 releases extend the 4.5 security-hardening series with more team-scoped configuration permissions, database restore fixes and repairs for broken Dockerfile healthchecks, concurrent builds and HTTP retries that could repeat actions. Coolify 4.5.2/3 add access-control fixes and correct deployment regressions introduced after 4.5.1. Operators should test healthchecks, API permissions and restores. - Status: Active - Published: 2026-10-26T08:37:06+13:00 - Updated: 2026-10-29T06:24:38+13:00 - Categories: Cloud & Infrastructure, Hosting, Deployment & DevOps - Tags: Coolify, deployment, Model Context Protocol, Observability, passkeys, security updates, self-hosting - Canonical HTML: https://beyondthe.news/dossiers/coolify-4-5-beta-server-patching-passkeys-metrics-security-access-control ## Latest material change Oct 28 Coolify 4.5.2/4.5.3: permission hardening, backup/restore fixes, Dockerfile HEALTHCHECK regression and duplicate-retry prevention. ## What changed On October 23, 2026, Coolify released v4.5.0 with beta automatic server security updates, reboot and risky-package warnings, fleet-level server and container metrics, passkey authentication, private Gitea repository deployment, new MCP resource-management tools, and Docker-registry deployment rollback. It adds pre-update Coolify database backups and improved secret rotation. Security fixes include encryption of plaintext secrets at rest, tighter team-scoped deployment queries, enforcing allowed IPs at the MCP endpoint and restricting system-wide Git sources to instance admins. This follows October 21 v4.4.7 and backports that addressed critical dependency CVEs, but v4.5.0 is a distinct feature-and-hardening release. On October 27, v4.5.1 followed with further security fixes: stored-secret access checks and hiding of locked/admin-only secrets in forms, Compose and API; server-transfer import/claim/archive restrictions; PostgreSQL restore scan protections and SQL error handling; local GitHub App webhook signature verification; team-scoped Gitea source access; redaction of database URLs; and Cloudflare client-IP handling for API allowlists. It also removed the `delete_from_coolify_only` service deletion flag (now HTTP 422) and discontinued Highlight log drains, while improving rolling-update proxy retries and drain times. On October 28, v4.5.2 added restrictions on viewing standalone database custom configuration, application commands and service settings; limited background task completion events to the correct team; fixed S3 backup signing and MySQL/MariaDB restore validation; and stopped logging Pushover payloads. Later that day, v4.5.3 restored existing Dockerfile HEALTHCHECK behaviour overridden since 4.5.1, fixed concurrent Railpack and Compose build failures, cleared orphaned SSH connections, prevented HTTP retries after a request had already been sent and repaired read:sensitive MCP token access to application/database configuration. ## Why it matters A small team operating its own deployment platform can now handle more security hygiene, server monitoring, recovery and access control inside one dashboard rather than assembling several separate tools. But automated OS patching is labelled beta: a reboot or package upgrade can interrupt production services, and rollout should be staged with backups and recovery plans. Passkeys and narrower resource permissions matter because a self-hosted control plane holds deployment credentials and production access. The 4.5.1 changes are operationally material for teams using API automation and for administrators whose deployment control plane contains secrets and backup credentials. API consumers must stop sending the removed deletion flag, review service deletion semantics, and migrate away from Highlight drains. Users should not infer confirmed exploitation from release-note descriptions alone. The v4.5.2 and v4.5.3 follow-ups are particularly relevant to multi-team self-hosted control planes: permissions and event scoping affect confidentiality, while restore handling, healthcheck overrides and duplicate HTTP retries affect production reliability. Test whether Dockerfile healthchecks survived upgrades from 4.5.1 and whether automated API actions can safely retry after timeouts. ## Patch management is beta, not a zero-risk toggle Coolify's server-patching beta offers per-server automatic security updates, reboot and risky-package warnings, with patch status visible in the server list. Operators should inventory critical workloads, test on nonproduction hosts, and plan maintenance windows before allowing unattended reboots. The release notes do not establish how every distribution or package policy behaves in production. ## Operational tooling grows beyond deployment v4.5.0 adds fleet metrics for servers and containers, disk/network/load charts, a file browser for applications/services/databases, a dashboard resource canvas, deployment-history navigation, registry-image rollback, CloudWatch log drains, pre-update database backups and GitLab system-hook deployments. It also supports private Gitea repositories and Smart Scan for build-pack detection. Some features depend on specific proxy, source or server configuration. ## Control-plane permissions receive concrete fixes Release notes say previously plaintext secrets are now encrypted at rest; deployment queries are scoped to team applications; MCP endpoints enforce allowed IPs; system-wide Git sources are instance-admin-only; server transfer bundle exports require update access; and custom log drains are validated. These are product-specific access-control changes, not proof that any particular Coolify deployment was compromised. Test key rotation and backup restoration as part of upgrade validation. ## How this differs from the earlier security patch Coolify v4.4.7 and patched v4.0–4.3 release lines addressed PHP2Shell and other critical dependency vulnerabilities on October 21. The October 23 v4.5.0 release includes broader operations features and additional application-level hardening. Administrators should compare their installed line against both release notes instead of assuming the earlier security patch includes v4.5 features. ## October 27: 4.5.1 adds security fixes and a breaking API change The 4.5.1 release notes explicitly tighten resource permission checks on stored secrets, server transfer, restore and API access, enforce local GitHub App webhook signatures and use Cloudflare's client IP for allowlist/audit handling. Service deletion no longer accepts `delete_from_coolify_only` (422); normal deletion is designed to work even if the server is unreachable. The Highlight log drain is removed after that service ended. Rolling deployments gain configurable drain time and proxy retries to reduce 502s. Test automation and access controls in staging before rollout. ## October 28: 4.5.2 and 4.5.3 close permission gaps and fix regressions v4.5.2 restricts custom database configuration and application commands to team admins/owners or API tokens with read:sensitive access, aligns service form permissions, scopes background task finish events by team and removes Pushover message payloads from logs. It also fixes S3v4 backup signing and validates MySQL/MariaDB restores before altering a database. v4.5.3 fixes a regression in which Coolify overrode existing Dockerfile HEALTHCHECK directives from v4.5.1, repairs concurrent Railpack builds and Compose runtime-variable errors, stops retrying timed-out HTTP requests after sending them, cleans up SSH processes and restores MCP read:sensitive token visibility. These are upstream-described fixes, not evidence of confirmed exploitation. ## Key details - Coolify v4.5.0 released October 23, 2026. - Automatic server security patching and reboot warnings are explicitly beta. - Adds passkey login, Gitea private repos, fleet metrics, MCP resource management and Docker registry rollback. - Security hardening covers plaintext secrets, team-scoped deployment queries, Git source roles and MCP IP allowlists. - Pre-update database backups and APP_KEY secret re-encryption command support recovery and rotation. - Coolify v4.5.1 published October 27, 2026; hardens stored secrets, server transfer, PostgreSQL restores, webhook signatures, team-scoped sources and Cloudflare IP allowlists. - Service deletion API rejects `delete_from_coolify_only` with 422; Highlight log drain removed. - Coolify 4.5.2 and 4.5.3 both released October 28, 2026. - 4.5.2 restricts sensitive application/database configuration and scopes task completion events to the right team. - 4.5.2 fixes S3v4 backup signing, MySQL/MariaDB restore validation and Pushover log payloads. - 4.5.3 preserves existing Dockerfile HEALTHCHECK directives after the 4.5.1 regression. - 4.5.3 avoids repeating HTTP actions after a timeout and repairs read:sensitive MCP token access. ## Builder takeaways - Patch critical dependency vulnerabilities on your current supported Coolify line, then plan the 4.5 upgrade separately. - Test automatic patching on a nonproduction server and explicitly plan for reboots and rollbacks. - Audit MCP endpoint allowlists, team permissions and Git source scopes after upgrading. - Verify that encrypted secrets and pre-update backups can be recovered before changing keys. - Audit API clients for the removed `delete_from_coolify_only` option and check deletion behaviour when target servers are offline. - Verify secret visibility, restore permissions, GitHub webhook signatures and proxy allowlists after upgrading to 4.5.1. - After upgrading to 4.5.3, verify custom Dockerfile healthchecks are active and test concurrent builds and restores. - Audit API token read:sensitive scopes, team event visibility and service configuration access. - Check integrations that retry HTTP requests after timeouts for idempotency. ## What to watch - Beta server patching reliability and supported Linux distribution/maintenance policies. - Follow-up security advisories or regressions in team resource access, MCP and secret rotation. - Operational overhead and performance impact of fleet metrics at scale. - Post-upgrade compatibility reports for service deletion and rolling-update drain settings. - Further 4.5.x access-control or deployment regression fixes and any explicit security advisories. ## Uncertainties - Release notes are first-party; independent production testing of the beta patching workflow is not yet established. - Not all deployments will use every new feature; exposure and required remediation depend on configuration. - No confirmed exploitation of the newly tightened application-level access checks is established by these release notes. ## Sources - [Coolify v4.5.0 release notes](https://github.com/coollabsio/coolify/releases/tag/v4.5.0) — Coolify maintainers · primary_release · 2026-10-23T00:00:00+13:00. Detailed features, security changes, caveats and linked PRs. - [Coolify v4.4.7 security release](https://github.com/coollabsio/coolify/releases/tag/v4.4.7) — Coolify maintainers · primary_prior_release · 2026-10-21T00:00:00+13:00. Separates earlier critical dependency remediation from v4.5 changes. - [Coolify Gitea App sources PR](https://github.com/coollabsio/coolify/pull/12234) — Coolify contributors · primary_implementation · 2026-10-23T00:00:00+13:00. Implementation evidence for private Gitea source support. - [Coolify MCP resource tools PR](https://github.com/coollabsio/coolify/pull/12163) — Coolify contributors · primary_implementation · 2026-10-23T00:00:00+13:00. Implementation reference for MCP tools. - [Coolify v4.5.1 release notes](https://github.com/coollabsio/coolify/releases/tag/v4.5.1) — Coolify maintainers · primary_release · 2026-10-27T00:00:00+13:00. Security fixes, breaking service-deletion flag, Highlight drain removal and rolling-update changes. - [Coolify v4.5.2 release notes](https://github.com/coollabsio/coolify/releases/tag/v4.5.2) — Coolify maintainers · primary_release · 2026-10-28T00:00:00+13:00. Permission restrictions, team-scoped task events, database restore and S3 backup fixes. - [Coolify v4.5.3 release notes](https://github.com/coollabsio/coolify/releases/tag/v4.5.3) — Coolify maintainers · primary_release · 2026-10-28T00:00:00+13:00. Dockerfile healthcheck regression, build concurrency, SSH cleanup, retry semantics and MCP token fix.