Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
82 vulnerabilities found for coder by coder
CVE-2026-126405 (GCVE-0-2026-126405)
Vulnerability from nvd – Published: 2026-11-13 09:35 – Updated: 2026-11-13 09:35
VLAI
EPSS
VEX
Title
Coder from 2.38.0 before 2.38.4 Memory Exhaustion DoS via Web Push
Summary
Coder 2.21.0 before 2.29.24, 2.30.0 before 2.34.16, 2.35.0 before 2.36.11, 2.37.0 before 2.37.8, and 2.38.0 before 2.38.4 reads Web Push endpoint responses in webpushSend with io.ReadAll, without a size limit or client timeout. Any authenticated user can register a subscription via POST /api/v2/users/{user}/webpush/subscription pointing to a server returning an endless body, exhausting coderd memory and crashing the API, dashboard, and workspace connections.
Severity
CWE
- CWE-400 - Uncontrolled Resource Consumption
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/coder/coder/security/advisorie… | vendor-advisory |
| https://www.vulncheck.com/advisories/coder-from-2… | third-party-advisory |
Impacted products
6 products
| Vendor | Product | Version | |
|---|---|---|---|
| coder | coder |
Affected:
2.38.0 , < 2.38.4
(semver)
Unaffected: 2.38.4 (semver) |
|
| coder | coder |
Affected:
2.37.0 , < 2.37.8
(semver)
Unaffected: 2.37.8 (semver) |
|
| coder | coder |
Affected:
2.36.0 , < 2.36.11
(semver)
Unaffected: 2.36.11 (semver) |
|
| coder | coder |
Affected:
2.30.0 , < 2.34.16
(semver)
Unaffected: 2.34.16 (semver) |
|
| coder | coder |
Affected:
2.21.0 , < 2.29.24
(semver)
Unaffected: 2.29.24 (semver) |
|
| coder | coder |
Affected:
2.35.0 , < 2.36.0
(semver)
Unaffected: 2.36.0 (semver) |
Date Public
2026-10-29 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/coder/coder/v2",
"product": "coder",
"vendor": "coder",
"versions": [
{
"lessThan": "2.38.4",
"status": "affected",
"version": "2.38.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.38.4",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/coder/coder/v2",
"product": "coder",
"vendor": "coder",
"versions": [
{
"lessThan": "2.37.8",
"status": "affected",
"version": "2.37.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.37.8",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/coder/coder/v2",
"product": "coder",
"vendor": "coder",
"versions": [
{
"lessThan": "2.36.11",
"status": "affected",
"version": "2.36.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.36.11",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/coder/coder/v2",
"product": "coder",
"vendor": "coder",
"versions": [
{
"lessThan": "2.34.16",
"status": "affected",
"version": "2.30.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.34.16",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/coder/coder/v2",
"product": "coder",
"vendor": "coder",
"versions": [
{
"lessThan": "2.29.24",
"status": "affected",
"version": "2.21.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.29.24",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/coder/coder/v2",
"product": "coder",
"vendor": "coder",
"versions": [
{
"lessThan": "2.36.0",
"status": "affected",
"version": "2.35.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.36.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.38.4",
"versionStartIncluding": "2.38.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.37.8",
"versionStartIncluding": "2.37.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.36.11",
"versionStartIncluding": "2.36.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.34.16",
"versionStartIncluding": "2.30.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.29.24",
"versionStartIncluding": "2.21.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.36.0",
"versionStartIncluding": "2.35.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "remediation developer",
"value": "BobbyHo"
}
],
"datePublic": "2026-10-29T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Coder 2.21.0 before 2.29.24, 2.30.0 before 2.34.16, 2.35.0 before 2.36.11, 2.37.0 before 2.37.8, and 2.38.0 before 2.38.4 reads Web Push endpoint responses in webpushSend with io.ReadAll, without a size limit or client timeout. Any authenticated user can register a subscription via POST /api/v2/users/{user}/webpush/subscription pointing to a server returning an endless body, exhausting coderd memory and crashing the API, dashboard, and workspace connections."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T09:35:44.966Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-64xh-rgcx-gg65)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/coder/coder/security/advisories/GHSA-64xh-rgcx-gg65"
},
{
"name": "VulnCheck Advisory: Coder from 2.38.0 before 2.38.4 Memory Exhaustion DoS via Web Push",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/coder-from-2.38.0-before-2.38.4-memory-exhaustion-dos-via-web-push"
}
],
"title": "Coder from 2.38.0 before 2.38.4 Memory Exhaustion DoS via Web Push",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-126405",
"datePublished": "2026-11-13T09:35:44.966Z",
"dateReserved": "2026-11-10T21:32:21.765Z",
"dateUpdated": "2026-11-13T09:35:44.966Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-126404 (GCVE-0-2026-126404)
Vulnerability from nvd – Published: 2026-11-13 09:35 – Updated: 2026-11-13 20:26
VLAI
EPSS
VEX
Title
Coder from 2.38.0 before 2.38.4 Privilege Escalation via API Key Creation
Summary
Coder 2.28.0 before 2.29.24, 2.30.0 before 2.34.16, 2.35.0 before 2.36.11, 2.37.0 before 2.37.8, and 2.38.0 before 2.38.4 does not restrict new API keys to the creating token's scopes, allow list, or expiry. A scoped API key or OAuth2 token holding key-creation permission can call POST /api/v2/users/{user}/keys/tokens to mint longer-lived coder:all keys, gaining the user's full privileges.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-13 20:25 UTC
CWE
- CWE-266 - Incorrect Privilege Assignment
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/coder/coder/security/advisorie… | vendor-advisory |
| https://www.vulncheck.com/advisories/coder-from-2… | third-party-advisory |
Impacted products
6 products
| Vendor | Product | Version | |
|---|---|---|---|
| coder | coder |
Affected:
2.38.0 , < 2.38.4
(semver)
Unaffected: 2.38.4 (semver) |
|
| coder | coder |
Affected:
2.37.0 , < 2.37.8
(semver)
Unaffected: 2.37.8 (semver) |
|
| coder | coder |
Affected:
2.36.0 , < 2.36.11
(semver)
Unaffected: 2.36.11 (semver) |
|
| coder | coder |
Affected:
2.30.0 , < 2.34.16
(semver)
Unaffected: 2.34.16 (semver) |
|
| coder | coder |
Affected:
2.28.0 , < 2.29.24
(semver)
Unaffected: 2.29.24 (semver) |
|
| coder | coder |
Affected:
2.35.0 , < 2.36.0
(semver)
Unaffected: 2.36.0 (semver) |
Date Public
2026-10-29 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-126404",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-13T20:25:47.107888Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T20:26:01.693Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/coder/coder/v2",
"product": "coder",
"vendor": "coder",
"versions": [
{
"lessThan": "2.38.4",
"status": "affected",
"version": "2.38.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.38.4",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/coder/coder/v2",
"product": "coder",
"vendor": "coder",
"versions": [
{
"lessThan": "2.37.8",
"status": "affected",
"version": "2.37.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.37.8",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/coder/coder/v2",
"product": "coder",
"vendor": "coder",
"versions": [
{
"lessThan": "2.36.11",
"status": "affected",
"version": "2.36.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.36.11",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/coder/coder/v2",
"product": "coder",
"vendor": "coder",
"versions": [
{
"lessThan": "2.34.16",
"status": "affected",
"version": "2.30.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.34.16",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/coder/coder/v2",
"product": "coder",
"vendor": "coder",
"versions": [
{
"lessThan": "2.29.24",
"status": "affected",
"version": "2.28.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.29.24",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/coder/coder/v2",
"product": "coder",
"vendor": "coder",
"versions": [
{
"lessThan": "2.36.0",
"status": "affected",
"version": "2.35.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.36.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.38.4",
"versionStartIncluding": "2.38.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.37.8",
"versionStartIncluding": "2.37.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.36.11",
"versionStartIncluding": "2.36.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.34.16",
"versionStartIncluding": "2.30.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.29.24",
"versionStartIncluding": "2.28.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.36.0",
"versionStartIncluding": "2.35.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "MutedCybersecurity"
},
{
"lang": "en",
"type": "remediation developer",
"value": "EhabY"
}
],
"datePublic": "2026-10-29T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Coder 2.28.0 before 2.29.24, 2.30.0 before 2.34.16, 2.35.0 before 2.36.11, 2.37.0 before 2.37.8, and 2.38.0 before 2.38.4 does not restrict new API keys to the creating token\u0027s scopes, allow list, or expiry. A scoped API key or OAuth2 token holding key-creation permission can call POST /api/v2/users/{user}/keys/tokens to mint longer-lived coder:all keys, gaining the user\u0027s full privileges."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-266",
"description": "Incorrect Privilege Assignment",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T09:35:45.631Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-x3gf-xv6p-56hf)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/coder/coder/security/advisories/GHSA-x3gf-xv6p-56hf"
},
{
"name": "VulnCheck Advisory: Coder from 2.38.0 before 2.38.4 Privilege Escalation via API Key Creation",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/coder-from-2.38.0-before-2.38.4-privilege-escalation-via-api-key-creation"
}
],
"title": "Coder from 2.38.0 before 2.38.4 Privilege Escalation via API Key Creation",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-126404",
"datePublished": "2026-11-13T09:35:45.631Z",
"dateReserved": "2026-11-10T21:32:21.765Z",
"dateUpdated": "2026-11-13T20:26:01.693Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-126403 (GCVE-0-2026-126403)
Vulnerability from nvd – Published: 2026-11-13 09:35 – Updated: 2026-11-13 15:55
VLAI
EPSS
VEX
Title
Coder 2.38.0 before 2.38.4 Authorization Bypass via External Agent Credentials Endpoint
Summary
Coder 2.26.0 before 2.29.24, 2.30.0 before 2.34.16, 2.35.0 before 2.36.11, 2.37.0 before 2.37.8, and 2.38.0 before 2.38.4 contains an improper authorization flaw in the external agent credentials endpoint, which returns the workspace agent token to users with only workspace read access rather than ssh permission. Authenticated users with roles such as Template Admin or Organization Admin can use the token to read the owner's private Git SSH key and Git provider OAuth tokens, and impersonate the agent to receive the owner's sessions.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-13 15:35 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/coder/coder/security/advisorie… | vendor-advisory |
| https://www.vulncheck.com/advisories/coder-2.38.0… | third-party-advisory |
Impacted products
6 products
| Vendor | Product | Version | |
|---|---|---|---|
| coder | coder |
Affected:
2.38.0 , < 2.38.4
(semver)
Unaffected: 2.38.4 (semver) |
|
| coder | coder |
Affected:
2.37.0 , < 2.37.8
(semver)
Unaffected: 2.37.8 (semver) |
|
| coder | coder |
Affected:
2.36.0 , < 2.36.11
(semver)
Unaffected: 2.36.11 (semver) |
|
| coder | coder |
Affected:
2.30.0 , < 2.34.16
(semver)
Unaffected: 2.34.16 (semver) |
|
| coder | coder |
Affected:
2.26.0 , < 2.29.24
(semver)
Unaffected: 2.29.24 (semver) |
|
| coder | coder |
Affected:
2.35.0 , < 2.36.0
(semver)
Unaffected: 2.36.0 (semver) |
Date Public
2026-10-29 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-126403",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-13T15:35:23.703298Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T15:55:21.571Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/coder/coder/v2",
"product": "coder",
"vendor": "coder",
"versions": [
{
"lessThan": "2.38.4",
"status": "affected",
"version": "2.38.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.38.4",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/coder/coder/v2",
"product": "coder",
"vendor": "coder",
"versions": [
{
"lessThan": "2.37.8",
"status": "affected",
"version": "2.37.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.37.8",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/coder/coder/v2",
"product": "coder",
"vendor": "coder",
"versions": [
{
"lessThan": "2.36.11",
"status": "affected",
"version": "2.36.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.36.11",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/coder/coder/v2",
"product": "coder",
"vendor": "coder",
"versions": [
{
"lessThan": "2.34.16",
"status": "affected",
"version": "2.30.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.34.16",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/coder/coder/v2",
"product": "coder",
"vendor": "coder",
"versions": [
{
"lessThan": "2.29.24",
"status": "affected",
"version": "2.26.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.29.24",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/coder/coder/v2",
"product": "coder",
"vendor": "coder",
"versions": [
{
"lessThan": "2.36.0",
"status": "affected",
"version": "2.35.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.36.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.38.4",
"versionStartIncluding": "2.38.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.37.8",
"versionStartIncluding": "2.37.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.36.11",
"versionStartIncluding": "2.36.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.34.16",
"versionStartIncluding": "2.30.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.29.24",
"versionStartIncluding": "2.26.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.36.0",
"versionStartIncluding": "2.35.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Habib0x0"
}
],
"datePublic": "2026-10-29T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Coder 2.26.0 before 2.29.24, 2.30.0 before 2.34.16, 2.35.0 before 2.36.11, 2.37.0 before 2.37.8, and 2.38.0 before 2.38.4 contains an improper authorization flaw in the external agent credentials endpoint, which returns the workspace agent token to users with only workspace read access rather than ssh permission. Authenticated users with roles such as Template Admin or Organization Admin can use the token to read the owner\u0027s private Git SSH key and Git provider OAuth tokens, and impersonate the agent to receive the owner\u0027s sessions."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"privilegesRequired": "HIGH",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T09:35:46.335Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-9frj-7f83-x984)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/coder/coder/security/advisories/GHSA-9frj-7f83-x984"
},
{
"name": "VulnCheck Advisory: Coder 2.38.0 before 2.38.4 Authorization Bypass via External Agent Credentials Endpoint",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/coder-2.38.0-before-2.38.4-authorization-bypass-via-external-agent-credentials-endpoint"
}
],
"title": "Coder 2.38.0 before 2.38.4 Authorization Bypass via External Agent Credentials Endpoint",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-126403",
"datePublished": "2026-11-13T09:35:46.335Z",
"dateReserved": "2026-11-10T21:32:21.765Z",
"dateUpdated": "2026-11-13T15:55:21.571Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-126308 (GCVE-0-2026-126308)
Vulnerability from nvd – Published: 2026-11-13 09:36 – Updated: 2026-11-13 09:36
VLAI
EPSS
VEX
Title
Coder 2.38.0 before 2.38.2 Session Token Leak via Sub-Agent External Apps
Summary
The web dashboard in Coder 2.24.0 before 2.29.23, 2.30.0 before 2.34.14, 2.35.0 before 2.36.9, 2.37.0 before 2.37.6, and 2.38.0 before 2.38.2 replaces the $SESSION_TOKEN placeholder in external app URLs with a full-access API key without checking whether the app belongs to a sub-agent. Code running in a workspace can register a disguised sub-agent app with a custom protocol URL, so the owner's click sends their API key to an attacker-chosen destination.
Severity
CWE
- CWE-201 - Insertion of Sensitive Information Into Sent Data
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/coder/coder/security/advisorie… | vendor-advisory |
| https://www.vulncheck.com/advisories/coder-2.38.0… | third-party-advisory |
Impacted products
6 products
| Vendor | Product | Version | |
|---|---|---|---|
| coder | coder |
Affected:
2.38.0 , < 2.38.2
(semver)
Unaffected: 2.38.2 (semver) |
|
| coder | coder |
Affected:
2.37.0 , < 2.37.6
(semver)
Unaffected: 2.37.6 (semver) |
|
| coder | coder |
Affected:
2.36.0 , < 2.36.9
(semver)
Unaffected: 2.36.9 (semver) |
|
| coder | coder |
Affected:
2.30.0 , < 2.34.14
(semver)
Unaffected: 2.34.14 (semver) |
|
| coder | coder |
Affected:
2.24.0 , < 2.29.23
(semver)
Unaffected: 2.29.23 (semver) |
|
| coder | coder |
Affected:
2.35.0 , < 2.36.0
(semver)
Unaffected: 2.36.0 (semver) |
Date Public
2026-10-27 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/coder/coder/v2",
"product": "coder",
"vendor": "coder",
"versions": [
{
"lessThan": "2.38.2",
"status": "affected",
"version": "2.38.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.38.2",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/coder/coder/v2",
"product": "coder",
"vendor": "coder",
"versions": [
{
"lessThan": "2.37.6",
"status": "affected",
"version": "2.37.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.37.6",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/coder/coder/v2",
"product": "coder",
"vendor": "coder",
"versions": [
{
"lessThan": "2.36.9",
"status": "affected",
"version": "2.36.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.36.9",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/coder/coder/v2",
"product": "coder",
"vendor": "coder",
"versions": [
{
"lessThan": "2.34.14",
"status": "affected",
"version": "2.30.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.34.14",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/coder/coder/v2",
"product": "coder",
"vendor": "coder",
"versions": [
{
"lessThan": "2.29.23",
"status": "affected",
"version": "2.24.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.29.23",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/coder/coder/v2",
"product": "coder",
"vendor": "coder",
"versions": [
{
"lessThan": "2.36.0",
"status": "affected",
"version": "2.35.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.36.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.38.2",
"versionStartIncluding": "2.38.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.37.6",
"versionStartIncluding": "2.37.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.36.9",
"versionStartIncluding": "2.36.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.34.14",
"versionStartIncluding": "2.30.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.29.23",
"versionStartIncluding": "2.24.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.36.0",
"versionStartIncluding": "2.35.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "manus-pi"
},
{
"lang": "en",
"type": "remediation developer",
"value": "EhabY"
}
],
"datePublic": "2026-10-27T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The web dashboard in Coder 2.24.0 before 2.29.23, 2.30.0 before 2.34.14, 2.35.0 before 2.36.9, 2.37.0 before 2.37.6, and 2.38.0 before 2.38.2 replaces the $SESSION_TOKEN placeholder in external app URLs with a full-access API key without checking whether the app belongs to a sub-agent. Code running in a workspace can register a disguised sub-agent app with a custom protocol URL, so the owner\u0027s click sends their API key to an attacker-chosen destination."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-201",
"description": "Insertion of Sensitive Information Into Sent Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T09:36:20.400Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-2x8w-q434-f76p)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/coder/coder/security/advisories/GHSA-2x8w-q434-f76p"
},
{
"name": "VulnCheck Advisory: Coder 2.38.0 before 2.38.2 Session Token Leak via Sub-Agent External Apps",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/coder-2.38.0-before-2.38.2-session-token-leak-via-sub-agent-external-apps"
}
],
"title": "Coder 2.38.0 before 2.38.2 Session Token Leak via Sub-Agent External Apps",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-126308",
"datePublished": "2026-11-13T09:36:20.400Z",
"dateReserved": "2026-11-10T20:16:44.443Z",
"dateUpdated": "2026-11-13T09:36:20.400Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-121967 (GCVE-0-2026-121967)
Vulnerability from nvd – Published: 2026-11-04 15:33 – Updated: 2026-11-04 18:13
VLAI
EPSS
VEX
Title
Coder before 2.29.22, 2.34.13, 2.35.10, 2.36.8, 2.37.5, and 2.38.1 AI Gateway Path Traversal
Summary
Coder 2.28.0 before 2.29.22, 2.30.0 before 2.34.13, 2.35.0 before 2.35.10, 2.36.0 before 2.36.8, 2.37.0 before 2.37.5, and 2.38.0 before 2.38.1 contains a path traversal vulnerability in the AI Gateway passthrough router, which forwards percent-encoded dot segments upstream without rejecting them. Authenticated users can send paths such as %2e%2e or ..%2F under allowlisted prefixes to reach unintended provider endpoints using the deployment's centrally managed provider key.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-04 18:13 UTC
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/coder/coder/security/advisorie… | vendor-advisory |
| https://github.com/coder/coder/pull/30178 | patchissue-tracking |
| https://www.vulncheck.com/advisories/coder-before… | third-party-advisory |
Impacted products
6 products
| Vendor | Product | Version | |
|---|---|---|---|
| coder | coder |
Affected:
2.37.0 , < 2.37.5
(semver)
Unaffected: 2.37.5 (semver) |
|
| coder | coder |
Affected:
2.36.0 , < 2.36.8
(semver)
Unaffected: 2.36.8 (semver) |
|
| coder | coder |
Affected:
2.35.0 , < 2.35.10
(semver)
Unaffected: 2.35.10 (semver) |
|
| coder | coder |
Affected:
2.30.0 , < 2.34.13
(semver)
Unaffected: 2.34.13 (semver) |
|
| coder | coder |
Affected:
2.28.0 , < 2.29.22
(semver)
Unaffected: 2.29.22 (semver) |
|
| coder | coder |
Affected:
2.38.0 , < 2.38.1
(semver)
Unaffected: 2.38.1 (semver) |
Date Public
2026-10-21 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-121967",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-04T18:13:18.040579Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T18:13:30.807Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/coder/coder/v2",
"product": "coder",
"vendor": "coder",
"versions": [
{
"lessThan": "2.37.5",
"status": "affected",
"version": "2.37.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.37.5",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/coder/coder/v2",
"product": "coder",
"vendor": "coder",
"versions": [
{
"lessThan": "2.36.8",
"status": "affected",
"version": "2.36.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.36.8",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/coder/coder/v2",
"product": "coder",
"vendor": "coder",
"versions": [
{
"lessThan": "2.35.10",
"status": "affected",
"version": "2.35.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.35.10",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/coder/coder/v2",
"product": "coder",
"vendor": "coder",
"versions": [
{
"lessThan": "2.34.13",
"status": "affected",
"version": "2.30.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.34.13",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/coder/coder/v2",
"product": "coder",
"vendor": "coder",
"versions": [
{
"lessThan": "2.29.22",
"status": "affected",
"version": "2.28.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.29.22",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/coder/coder/v2",
"product": "coder",
"vendor": "coder",
"versions": [
{
"lessThan": "2.38.1",
"status": "affected",
"version": "2.38.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.38.1",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.37.5",
"versionStartIncluding": "2.37.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.36.8",
"versionStartIncluding": "2.36.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.35.10",
"versionStartIncluding": "2.35.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.34.13",
"versionStartIncluding": "2.30.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.29.22",
"versionStartIncluding": "2.28.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.38.1",
"versionStartIncluding": "2.38.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2026-10-21T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Coder 2.28.0 before 2.29.22, 2.30.0 before 2.34.13, 2.35.0 before 2.35.10, 2.36.0 before 2.36.8, 2.37.0 before 2.37.5, and 2.38.0 before 2.38.1 contains a path traversal vulnerability in the AI Gateway passthrough router, which forwards percent-encoded dot segments upstream without rejecting them. Authenticated users can send paths such as %2e%2e or ..%2F under allowlisted prefixes to reach unintended provider endpoints using the deployment\u0027s centrally managed provider key."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 2.3,
"baseSeverity": "LOW",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T15:33:28.808Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-373r-678h-hjc6)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/coder/coder/security/advisories/GHSA-373r-678h-hjc6"
},
{
"name": "GitHub Pull Request #30178",
"tags": [
"patch",
"issue-tracking"
],
"url": "https://github.com/coder/coder/pull/30178"
},
{
"name": "VulnCheck Advisory: Coder before 2.29.22, 2.34.13, 2.35.10, 2.36.8, 2.37.5, and 2.38.1 AI Gateway Path Traversal",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/coder-before-2.29.22-2.34.13-2.35.10-2.36.8-2.37.5-and-2.38.1-ai-gateway-path-traversal"
}
],
"title": "Coder before 2.29.22, 2.34.13, 2.35.10, 2.36.8, 2.37.5, and 2.38.1 AI Gateway Path Traversal",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-121967",
"datePublished": "2026-11-04T15:33:28.808Z",
"dateReserved": "2026-11-04T12:48:39.813Z",
"dateUpdated": "2026-11-04T18:13:30.807Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-118687 (GCVE-0-2026-118687)
Vulnerability from nvd – Published: 2026-10-28 18:59 – Updated: 2026-10-29 20:54
VLAI
EPSS
VEX
Title
Coder before 2.29.21, 2.34.12, 2.35.9, 2.36.7, and 2.37.4 Missing Audience Validation in GCP Instance-Identity Authentication
Summary
Coder before 2.29.21, 2.30.0 before 2.34.12, 2.35.0 before 2.35.9, 2.36.0 before 2.36.7, and 2.37.0 before 2.37.4 does not validate the audience claim of GCE instance-identity JWTs at the POST /api/v2/workspaceagents/google-instance-identity endpoint. Attackers who obtain an unexpired format=full identity token minted for another relying party can replay it to obtain that workspace agent's session token, which remains valid until the workspace's next build.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-29 15:28 UTC
CWE
- CWE-441 - Unintended Proxy or Intermediary ('Confused Deputy')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/coder/coder/security/advisorie… | vendor-advisory |
| https://www.vulncheck.com/advisories/coder-before… | third-party-advisory |
Impacted products
5 products
| Vendor | Product | Version | |
|---|---|---|---|
| coder | coder |
Affected:
2.37.0 , < 2.37.4
(semver)
Unaffected: 2.37.4 (semver) |
|
| coder | coder |
Affected:
2.36.0 , < 2.36.7
(semver)
Unaffected: 2.36.7 (semver) |
|
| coder | coder |
Affected:
2.35.0 , < 2.35.9
(semver)
Unaffected: 2.35.9 (semver) |
|
| coder | coder |
Affected:
2.30.0 , < 2.34.12
(semver)
Unaffected: 2.34.12 (semver) |
|
| coder | coder |
Affected:
0 , < 2.29.21
(semver)
Unaffected: 2.29.21 (semver) |
Date Public
2026-10-13 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-118687",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-29T15:28:59.226439Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T20:54:16.473Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/coder/coder/v2",
"product": "coder",
"vendor": "coder",
"versions": [
{
"lessThan": "2.37.4",
"status": "affected",
"version": "2.37.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.37.4",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/coder/coder/v2",
"product": "coder",
"vendor": "coder",
"versions": [
{
"lessThan": "2.36.7",
"status": "affected",
"version": "2.36.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.36.7",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/coder/coder/v2",
"product": "coder",
"vendor": "coder",
"versions": [
{
"lessThan": "2.35.9",
"status": "affected",
"version": "2.35.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.35.9",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/coder/coder/v2",
"product": "coder",
"vendor": "coder",
"versions": [
{
"lessThan": "2.34.12",
"status": "affected",
"version": "2.30.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.34.12",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/coder/coder/v2",
"product": "coder",
"vendor": "coder",
"versions": [
{
"lessThan": "2.29.21",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.29.21",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.37.4",
"versionStartIncluding": "2.37.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.36.7",
"versionStartIncluding": "2.36.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.35.9",
"versionStartIncluding": "2.35.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.34.12",
"versionStartIncluding": "2.30.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.29.21",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "matte1782"
}
],
"datePublic": "2026-10-13T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Coder before 2.29.21, 2.30.0 before 2.34.12, 2.35.0 before 2.35.9, 2.36.0 before 2.36.7, and 2.37.0 before 2.37.4 does not validate the audience claim of GCE instance-identity JWTs at the POST /api/v2/workspaceagents/google-instance-identity endpoint. Attackers who obtain an unexpired format=full identity token minted for another relying party can replay it to obtain that workspace agent\u0027s session token, which remains valid until the workspace\u0027s next build."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-441",
"description": "Unintended Proxy or Intermediary (\u0027Confused Deputy\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-28T18:59:56.265Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-24vh-q7rg-243w)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/coder/coder/security/advisories/GHSA-24vh-q7rg-243w"
},
{
"name": "VulnCheck Advisory: Coder before 2.29.21, 2.34.12, 2.35.9, 2.36.7, and 2.37.4 Missing Audience Validation in GCP Instance-Identity Authentication",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/coder-before-2.29.21-2.34.12-2.35.9-2.36.7-and-2.37.4-missing-audience-validation-in-gcp-instance-identity-authentication"
}
],
"title": "Coder before 2.29.21, 2.34.12, 2.35.9, 2.36.7, and 2.37.4 Missing Audience Validation in GCP Instance-Identity Authentication",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-118687",
"datePublished": "2026-10-28T18:59:56.265Z",
"dateReserved": "2026-10-28T17:31:29.498Z",
"dateUpdated": "2026-10-29T20:54:16.473Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111934 (GCVE-0-2026-111934)
Vulnerability from nvd – Published: 2026-10-17 18:46 – Updated: 2026-10-19 16:39
VLAI
EPSS
VEX
Title
Coder before 2.34.7 IP Spoofing via X-Forwarded-For Header
Summary
Coder before 2.34.7 contains an IP spoofing vulnerability in the ExtractRealIPAddress middleware that trusts the leftmost, client-supplied X-Forwarded-For value instead of the client IP appended by a reverse proxy. Attackers can send forged X-Forwarded-For values through appending proxies to bypass per-IP rate limits on login, one-time passcode, and password validation endpoints, enabling brute-force attacks, and to falsify IP addresses recorded in audit logs.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-19 15:35 UTC
CWE
- CWE-348 - Use of Less Trusted Source
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/coder/coder/security/advisorie… | vendor-advisory |
| https://www.vulncheck.com/advisories/coder-before… | third-party-advisory |
Impacted products
Date Public
2026-08-11 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111934",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T15:35:37.487571Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T16:39:17.593Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/coder/coder/v2",
"product": "coder",
"vendor": "coder",
"versions": [
{
"lessThan": "2.34.7",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.34.7",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.34.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.34.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2026-08-11T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Coder before 2.34.7 contains an IP spoofing vulnerability in the ExtractRealIPAddress middleware that trusts the leftmost, client-supplied X-Forwarded-For value instead of the client IP appended by a reverse proxy. Attackers can send forged X-Forwarded-For values through appending proxies to bypass per-IP rate limits on login, one-time passcode, and password validation endpoints, enabling brute-force attacks, and to falsify IP addresses recorded in audit logs."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.7,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-348",
"description": "Use of Less Trusted Source",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-17T18:46:44.142Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-vprw-xcrv-287h)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/coder/coder/security/advisories/GHSA-vprw-xcrv-287h"
},
{
"name": "VulnCheck Advisory: Coder before 2.34.7 IP Spoofing via X-Forwarded-For Header",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/coder-before-2.34.7-ip-spoofing-via-x-forwarded-for-header"
}
],
"title": "Coder before 2.34.7 IP Spoofing via X-Forwarded-For Header",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-111934",
"datePublished": "2026-10-17T18:46:44.142Z",
"dateReserved": "2026-10-17T12:20:52.372Z",
"dateUpdated": "2026-10-19T16:39:17.593Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111933 (GCVE-0-2026-111933)
Vulnerability from nvd – Published: 2026-10-17 18:46 – Updated: 2026-10-19 15:12
VLAI
EPSS
VEX
Title
Coder before 2.34.2 User Enumeration via Login Placeholder Hash
Summary
Coder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before 2.34.2 contains a user enumeration vulnerability because userpassword.Compare() substitutes a placeholder hash derived from the string "hunter2" when a stored password hash is empty. Unauthenticated attackers can submit logins with the password "hunter2" and distinguish HTTP 403 from 401 responses to enumerate valid accounts and reveal the authentication provider of SSO-only users.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-19 15:09 UTC
CWE
- CWE-203 - Observable Discrepancy
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/coder/coder/security/advisorie… | vendor-advisory |
| https://www.vulncheck.com/advisories/coder-before… | third-party-advisory |
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| coder | coder |
Affected:
2.34.0 , < 2.34.2
(semver)
Unaffected: 2.34.2 (semver) |
|
| coder | coder |
Affected:
2.33.0 , < 2.33.8
(semver)
Unaffected: 2.33.8 (semver) |
|
| coder | coder |
Affected:
2.30.0 , < 2.32.7
(semver)
Unaffected: 2.32.7 (semver) |
|
| coder | coder |
Affected:
0 , < 2.29.17
(semver)
Unaffected: 2.29.17 (semver) |
Date Public
2026-06-12 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111933",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T15:09:55.562810Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T15:12:57.230Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/coder/coder/v2",
"product": "coder",
"vendor": "coder",
"versions": [
{
"lessThan": "2.34.2",
"status": "affected",
"version": "2.34.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.34.2",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/coder/coder/v2",
"product": "coder",
"vendor": "coder",
"versions": [
{
"lessThan": "2.33.8",
"status": "affected",
"version": "2.33.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.33.8",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/coder/coder/v2",
"product": "coder",
"vendor": "coder",
"versions": [
{
"lessThan": "2.32.7",
"status": "affected",
"version": "2.30.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.32.7",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/coder/coder/v2",
"product": "coder",
"vendor": "coder",
"versions": [
{
"lessThan": "2.29.17",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.29.17",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.34.2",
"versionStartIncluding": "2.34.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.33.8",
"versionStartIncluding": "2.33.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.32.7",
"versionStartIncluding": "2.30.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.29.17",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2026-06-12T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Coder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before 2.34.2 contains a user enumeration vulnerability because userpassword.Compare() substitutes a placeholder hash derived from the string \"hunter2\" when a stored password hash is empty. Unauthenticated attackers can submit logins with the password \"hunter2\" and distinguish HTTP 403 from 401 responses to enumerate valid accounts and reveal the authentication provider of SSO-only users."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.7,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-203",
"description": "Observable Discrepancy",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-17T18:46:43.456Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-8fxq-53rx-ph5f)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/coder/coder/security/advisories/GHSA-8fxq-53rx-ph5f"
},
{
"name": "VulnCheck Advisory: Coder before 2.34.2 User Enumeration via Login Placeholder Hash",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/coder-before-2.34.2-user-enumeration-via-login-placeholder-hash"
}
],
"title": "Coder before 2.34.2 User Enumeration via Login Placeholder Hash",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-111933",
"datePublished": "2026-10-17T18:46:43.456Z",
"dateReserved": "2026-10-17T12:20:52.372Z",
"dateUpdated": "2026-10-19T15:12:57.230Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111932 (GCVE-0-2026-111932)
Vulnerability from nvd – Published: 2026-10-17 18:46 – Updated: 2026-10-22 02:08
VLAI
EPSS
VEX
Title
Coder before 2.34.2 Stored HTML Injection via Appearance Settings
Summary
Coder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before 2.34.2 contains a stored HTML injection vulnerability because the ApplicationName and LogoURL appearance settings are rendered into HTML output without sufficient escaping. Attackers with the Owner role can store HTML markup in these settings that renders in the Coder dashboard and in SMTP notification emails sent to other deployment users.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-22 02:08 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/coder/coder/security/advisorie… | vendor-advisory |
| https://www.vulncheck.com/advisories/coder-before… | third-party-advisory |
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| coder | coder |
Affected:
2.34.0 , < 2.34.2
(semver)
Unaffected: 2.34.2 (semver) |
|
| coder | coder |
Affected:
2.33.0 , < 2.33.8
(semver)
Unaffected: 2.33.8 (semver) |
|
| coder | coder |
Affected:
2.30.0 , < 2.32.7
(semver)
Unaffected: 2.32.7 (semver) |
|
| coder | coder |
Affected:
0 , < 2.29.17
(semver)
Unaffected: 2.29.17 (semver) |
Date Public
2026-06-12 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111932",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-22T02:08:37.846699Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-22T02:08:49.284Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/coder/coder/v2",
"product": "coder",
"vendor": "coder",
"versions": [
{
"lessThan": "2.34.2",
"status": "affected",
"version": "2.34.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.34.2",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/coder/coder/v2",
"product": "coder",
"vendor": "coder",
"versions": [
{
"lessThan": "2.33.8",
"status": "affected",
"version": "2.33.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.33.8",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/coder/coder/v2",
"product": "coder",
"vendor": "coder",
"versions": [
{
"lessThan": "2.32.7",
"status": "affected",
"version": "2.30.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.32.7",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/coder/coder/v2",
"product": "coder",
"vendor": "coder",
"versions": [
{
"lessThan": "2.29.17",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.29.17",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.34.2",
"versionStartIncluding": "2.34.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.33.8",
"versionStartIncluding": "2.33.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.32.7",
"versionStartIncluding": "2.30.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.29.17",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2026-06-12T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Coder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before 2.34.2 contains a stored HTML injection vulnerability because the ApplicationName and LogoURL appearance settings are rendered into HTML output without sufficient escaping. Attackers with the Owner role can store HTML markup in these settings that renders in the Coder dashboard and in SMTP notification emails sent to other deployment users."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"privilegesRequired": "HIGH",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "LOW",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.4,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-17T18:46:42.757Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-h58c-xccx-75m3)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/coder/coder/security/advisories/GHSA-h58c-xccx-75m3"
},
{
"name": "VulnCheck Advisory: Coder before 2.34.2 Stored HTML Injection via Appearance Settings",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/coder-before-2.34.2-stored-html-injection-via-appearance-settings"
}
],
"title": "Coder before 2.34.2 Stored HTML Injection via Appearance Settings",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-111932",
"datePublished": "2026-10-17T18:46:42.757Z",
"dateReserved": "2026-10-17T12:20:52.372Z",
"dateUpdated": "2026-10-22T02:08:49.284Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111931 (GCVE-0-2026-111931)
Vulnerability from nvd – Published: 2026-10-17 18:46 – Updated: 2026-10-18 11:42
VLAI
EPSS
VEX
Title
Coder 2.0.0 before 2.34.8 Open Redirect via Workspace App Proxy
Summary
Coder from 2.0.0 before 2.34.8 contains an open redirect vulnerability in handleAPIKeySmuggling that allows attackers to redirect users externally via unsanitized r.URL.Path values. Attackers can craft links on trusted workspace app subdomains with paths beginning with double slashes, which become scheme-relative redirects to attacker sites for phishing.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-18 11:16 UTC
CWE
- CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/coder/coder/security/advisorie… | vendor-advisory |
| https://www.vulncheck.com/advisories/coder-2.0.0-… | third-party-advisory |
Impacted products
Date Public
2026-08-10 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111931",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-18T11:16:07.689897Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-18T11:42:56.130Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/coder/coder/v2",
"product": "coder",
"vendor": "coder",
"versions": [
{
"lessThan": "2.34.8",
"status": "affected",
"version": "2.0.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.34.8",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.34.8",
"versionStartIncluding": "2.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2026-08-10T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Coder from 2.0.0 before 2.34.8 contains an open redirect vulnerability in handleAPIKeySmuggling that allows attackers to redirect users externally via unsanitized r.URL.Path values. Attackers can craft links on trusted workspace app subdomains with paths beginning with double slashes, which become scheme-relative redirects to attacker sites for phishing."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-601",
"description": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-17T18:46:42.064Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-98qx-9p2x-c4wh)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/coder/coder/security/advisories/GHSA-98qx-9p2x-c4wh"
},
{
"name": "VulnCheck Advisory: Coder 2.0.0 before 2.34.8 Open Redirect via Workspace App Proxy",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/coder-2.0.0-before-2.34.8-open-redirect-via-workspace-app-proxy"
}
],
"title": "Coder 2.0.0 before 2.34.8 Open Redirect via Workspace App Proxy",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-111931",
"datePublished": "2026-10-17T18:46:42.064Z",
"dateReserved": "2026-10-17T12:20:52.372Z",
"dateUpdated": "2026-10-18T11:42:56.130Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111930 (GCVE-0-2026-111930)
Vulnerability from nvd – Published: 2026-10-17 18:46 – Updated: 2026-10-19 21:32
VLAI
EPSS
VEX
Title
Coder from 2.26.0 before 2.34.8 Information Disclosure via Workspace ACL Endpoint
Summary
Coder from 2.26.0 before 2.34.8 contains an incorrect authorization flaw in the GET /api/v2/workspaces/{id}/acl endpoint, which checks only workspace read access and then fetches group members using an elevated system context. Authenticated users granted workspace use access can query the endpoint to harvest group members' emails, login types, status, and last-seen and creation timestamps.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-19 21:32 UTC
CWE
- CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/coder/coder/security/advisorie… | vendor-advisory |
| https://www.vulncheck.com/advisories/coder-from-2… | third-party-advisory |
Impacted products
Date Public
2026-08-10 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111930",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T21:32:23.815680Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T21:32:31.858Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/coder/coder/v2",
"product": "coder",
"vendor": "coder",
"versions": [
{
"lessThan": "2.34.8",
"status": "affected",
"version": "2.26.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.34.8",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.34.8",
"versionStartIncluding": "2.26.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2026-08-10T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Coder from 2.26.0 before 2.34.8 contains an incorrect authorization flaw in the GET /api/v2/workspaces/{id}/acl endpoint, which checks only workspace read access and then fetches group members using an elevated system context. Authenticated users granted workspace use access can query the endpoint to harvest group members\u0027 emails, login types, status, and last-seen and creation timestamps."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-17T18:46:41.399Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-cvrm-2xxr-hpcv)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/coder/coder/security/advisories/GHSA-cvrm-2xxr-hpcv"
},
{
"name": "VulnCheck Advisory: Coder from 2.26.0 before 2.34.8 Information Disclosure via Workspace ACL Endpoint",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/coder-from-2.26.0-before-2.34.8-information-disclosure-via-workspace-acl-endpoint"
}
],
"title": "Coder from 2.26.0 before 2.34.8 Information Disclosure via Workspace ACL Endpoint",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-111930",
"datePublished": "2026-10-17T18:46:41.399Z",
"dateReserved": "2026-10-17T12:20:52.372Z",
"dateUpdated": "2026-10-19T21:32:31.858Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111929 (GCVE-0-2026-111929)
Vulnerability from nvd – Published: 2026-10-17 18:46 – Updated: 2026-10-19 16:39
VLAI
EPSS
VEX
Title
Coder 2.30.0 before 2.34.8 Cross-Organization File Disclosure via DownloadFile RPC
Summary
Coder from 2.30.0 before 2.34.8 contains an authorization bypass vulnerability in the provisioner daemon DownloadFile gRPC handler that allows authenticated provisioner daemons to download other organizations' cached Terraform module archives. Attackers with an org-scoped provisioner key and a known file UUID can retrieve module source code exposing infrastructure topology or embedded secrets.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-19 15:35 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/coder/coder/security/advisorie… | vendor-advisory |
| https://www.vulncheck.com/advisories/coder-2.30.0… | third-party-advisory |
Impacted products
Date Public
2026-08-10 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111929",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T15:35:36.030783Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T16:39:24.356Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/coder/coder/v2",
"product": "coder",
"vendor": "coder",
"versions": [
{
"lessThan": "2.34.8",
"status": "affected",
"version": "2.30.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.34.8",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.34.8",
"versionStartIncluding": "2.30.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2026-08-10T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Coder from 2.30.0 before 2.34.8 contains an authorization bypass vulnerability in the provisioner daemon DownloadFile gRPC handler that allows authenticated provisioner daemons to download other organizations\u0027 cached Terraform module archives. Attackers with an org-scoped provisioner key and a known file UUID can retrieve module source code exposing infrastructure topology or embedded secrets."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "HIGH",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-17T18:46:40.707Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-hrhj-hpwc-9hmc)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/coder/coder/security/advisories/GHSA-hrhj-hpwc-9hmc"
},
{
"name": "VulnCheck Advisory: Coder 2.30.0 before 2.34.8 Cross-Organization File Disclosure via DownloadFile RPC",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/coder-2.30.0-before-2.34.8-cross-organization-file-disclosure-via-downloadfile-rpc"
}
],
"title": "Coder 2.30.0 before 2.34.8 Cross-Organization File Disclosure via DownloadFile RPC",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-111929",
"datePublished": "2026-10-17T18:46:40.707Z",
"dateReserved": "2026-10-17T12:19:42.359Z",
"dateUpdated": "2026-10-19T16:39:24.356Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111928 (GCVE-0-2026-111928)
Vulnerability from nvd – Published: 2026-10-17 18:46 – Updated: 2026-10-19 15:03
VLAI
EPSS
VEX
Title
Coder 2.0.0 before 2.34.8 Authorization Bypass via User-Level ACL in RBAC Policy
Summary
Coder from 2.0.0 before 2.34.8 contains an incorrect authorization vulnerability in the acl_allow rule of coderd/rbac/policy.rego, which does not verify organization membership for per-user ACL entries, and organization member removal does not scrub those entries. Authenticated users removed from an organization can keep accessing previously granted org-scoped resources such as templates and workspaces via the API.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-19 15:02 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/coder/coder/security/advisorie… | vendor-advisory |
| https://www.vulncheck.com/advisories/coder-2.0.0-… | third-party-advisory |
Impacted products
Date Public
2026-08-10 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111928",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T15:02:13.942781Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T15:03:05.568Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/coder/coder/v2",
"product": "coder",
"vendor": "coder",
"versions": [
{
"lessThan": "2.34.8",
"status": "affected",
"version": "2.0.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.34.8",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.34.8",
"versionStartIncluding": "2.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2026-08-10T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Coder from 2.0.0 before 2.34.8 contains an incorrect authorization vulnerability in the acl_allow rule of coderd/rbac/policy.rego, which does not verify organization membership for per-user ACL entries, and organization member removal does not scrub those entries. Authenticated users removed from an organization can keep accessing previously granted org-scoped resources such as templates and workspaces via the API."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-17T18:46:40.029Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-7v78-w67v-pm2g)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/coder/coder/security/advisories/GHSA-7v78-w67v-pm2g"
},
{
"name": "VulnCheck Advisory: Coder 2.0.0 before 2.34.8 Authorization Bypass via User-Level ACL in RBAC Policy",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/coder-2.0.0-before-2.34.8-authorization-bypass-via-user-level-acl-in-rbac-policy"
}
],
"title": "Coder 2.0.0 before 2.34.8 Authorization Bypass via User-Level ACL in RBAC Policy",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-111928",
"datePublished": "2026-10-17T18:46:40.029Z",
"dateReserved": "2026-10-17T12:19:42.359Z",
"dateUpdated": "2026-10-19T15:03:05.568Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111927 (GCVE-0-2026-111927)
Vulnerability from nvd – Published: 2026-10-17 18:46 – Updated: 2026-10-21 21:45
VLAI
EPSS
VEX
Title
Coder before 2.35.4 Credential Theft via Workspace Proxy Hostname Prefix Match
Summary
Coder before 2.29.20, 2.33.0 before 2.33.12, 2.34.0 before 2.34.8, and 2.35.0 before 2.35.4 contains an improper hostname validation flaw in GetWorkspaceProxyByHostname whose SIMILAR TO pattern performs a prefix match, so any domain that is a string prefix of a workspace-proxy access URL is trusted as a proxy. Attackers owning such a domain can lure an authenticated victim to a crafted /api/v2/applications/auth-redirect link, capture the redirected application_connect API key, and replay it to access the victim's workspace apps.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-21 21:45 UTC
CWE
- CWE-522 - Insufficiently Protected Credentials
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/coder/coder/security/advisorie… | vendor-advisory |
| https://www.vulncheck.com/advisories/coder-before… | third-party-advisory |
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| coder | coder |
Affected:
2.35.0 , < 2.35.4
(semver)
Unaffected: 2.35.4 (semver) |
|
| coder | coder |
Affected:
2.34.0 , < 2.34.8
(semver)
Unaffected: 2.34.8 (semver) |
|
| coder | coder |
Affected:
2.33.0 , < 2.33.12
(semver)
Unaffected: 2.33.12 (semver) |
|
| coder | coder |
Affected:
0 , < 2.29.20
(semver)
Unaffected: 2.29.20 (semver) |
Date Public
2026-08-10 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111927",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-21T21:45:28.936667Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T21:45:39.027Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/coder/coder/v2",
"product": "coder",
"vendor": "coder",
"versions": [
{
"lessThan": "2.35.4",
"status": "affected",
"version": "2.35.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.35.4",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/coder/coder/v2",
"product": "coder",
"vendor": "coder",
"versions": [
{
"lessThan": "2.34.8",
"status": "affected",
"version": "2.34.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.34.8",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/coder/coder/v2",
"product": "coder",
"vendor": "coder",
"versions": [
{
"lessThan": "2.33.12",
"status": "affected",
"version": "2.33.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.33.12",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/coder/coder/v2",
"product": "coder",
"vendor": "coder",
"versions": [
{
"lessThan": "2.29.20",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.29.20",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.35.4",
"versionStartIncluding": "2.35.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.34.8",
"versionStartIncluding": "2.34.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.33.12",
"versionStartIncluding": "2.33.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.29.20",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2026-08-10T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Coder before 2.29.20, 2.33.0 before 2.33.12, 2.34.0 before 2.34.8, and 2.35.0 before 2.35.4 contains an improper hostname validation flaw in GetWorkspaceProxyByHostname whose SIMILAR TO pattern performs a prefix match, so any domain that is a string prefix of a workspace-proxy access URL is trusted as a proxy. Attackers owning such a domain can lure an authenticated victim to a crafted /api/v2/applications/auth-redirect link, capture the redirected application_connect API key, and replay it to access the victim\u0027s workspace apps."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-522",
"description": "Insufficiently Protected Credentials",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-17T18:46:39.347Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-h58h-qvv5-xvwg)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/coder/coder/security/advisories/GHSA-h58h-qvv5-xvwg"
},
{
"name": "VulnCheck Advisory: Coder before 2.35.4 Credential Theft via Workspace Proxy Hostname Prefix Match",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/coder-before-2.35.4-credential-theft-via-workspace-proxy-hostname-prefix-match"
}
],
"title": "Coder before 2.35.4 Credential Theft via Workspace Proxy Hostname Prefix Match",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-111927",
"datePublished": "2026-10-17T18:46:39.347Z",
"dateReserved": "2026-10-17T12:19:42.358Z",
"dateUpdated": "2026-10-21T21:45:39.027Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111926 (GCVE-0-2026-111926)
Vulnerability from nvd – Published: 2026-10-17 18:46 – Updated: 2026-10-18 11:42
VLAI
EPSS
VEX
Title
Coder from 2.10.0 before 2.34.8 Information Disclosure via Agent /debug/manifest
Summary
Coder from 2.10.0 before 2.34.8 has an unauthenticated agent debug HTTP server on 127.0.0.1:2113 whose /debug/manifest handler returns the full agent manifest, including template-provided environment variable values. A lower-privileged Unix user or process in the same workspace can query this endpoint to read credentials such as cloud keys or registry tokens.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-18 11:16 UTC
CWE
- CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/coder/coder/security/advisorie… | vendor-advisory |
| https://www.vulncheck.com/advisories/coder-from-2… | third-party-advisory |
Impacted products
Date Public
2026-08-10 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111926",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-18T11:16:42.466389Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-18T11:42:56.278Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/coder/coder/v2",
"product": "coder",
"vendor": "coder",
"versions": [
{
"lessThan": "2.34.8",
"status": "affected",
"version": "2.10.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.34.8",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.34.8",
"versionStartIncluding": "2.10.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2026-08-10T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Coder from 2.10.0 before 2.34.8 has an unauthenticated agent debug HTTP server on 127.0.0.1:2113 whose /debug/manifest handler returns the full agent manifest, including template-provided environment variable values. A lower-privileged Unix user or process in the same workspace can query this endpoint to read credentials such as cloud keys or registry tokens."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 3.3,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-17T18:46:38.631Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-73wg-wxvv-9r4j)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/coder/coder/security/advisories/GHSA-73wg-wxvv-9r4j"
},
{
"name": "VulnCheck Advisory: Coder from 2.10.0 before 2.34.8 Information Disclosure via Agent /debug/manifest",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/coder-from-2.10.0-before-2.34.8-information-disclosure-via-agent-debug-manifest"
}
],
"title": "Coder from 2.10.0 before 2.34.8 Information Disclosure via Agent /debug/manifest",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-111926",
"datePublished": "2026-10-17T18:46:38.631Z",
"dateReserved": "2026-10-17T12:19:42.358Z",
"dateUpdated": "2026-10-18T11:42:56.278Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-71435 (GCVE-0-2025-71435)
Vulnerability from nvd – Published: 2026-10-17 18:46 – Updated: 2026-10-19 14:40
VLAI
EPSS
VEX
Title
Coder before 2.23.0 Session Expiration Bypass via OIDC Without Refresh Token
Summary
Coder before 2.23.0 contains a session expiration bypass vulnerability that allows authenticated users to retain access after OIDC token expiry when no refresh token is issued. Users can keep their APIKey cookie active through regular use, extending it every 24 hours to access Coder indefinitely after losing OIDC authorization.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-19 14:39 UTC
CWE
- CWE-613 - Insufficient Session Expiration
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/coder/coder/security/advisorie… | vendor-advisory |
| https://www.vulncheck.com/advisories/coder-before… | third-party-advisory |
Impacted products
Date Public
2025-08-28 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-71435",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T14:39:33.929314Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T14:40:10.199Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/coder/coder/v2",
"product": "coder",
"vendor": "coder",
"versions": [
{
"lessThan": "2.23.0",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.23.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.23.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "spikecurtis"
}
],
"datePublic": "2025-08-28T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Coder before 2.23.0 contains a session expiration bypass vulnerability that allows authenticated users to retain access after OIDC token expiry when no refresh token is issued. Users can keep their APIKey cookie active through regular use, extending it every 24 hours to access Coder indefinitely after losing OIDC authorization."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 2.3,
"baseSeverity": "LOW",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.2,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-613",
"description": "Insufficient Session Expiration",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-17T18:46:07.735Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-3rw9-wmc8-8948)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/coder/coder/security/advisories/GHSA-3rw9-wmc8-8948"
},
{
"name": "VulnCheck Advisory: Coder before 2.23.0 Session Expiration Bypass via OIDC Without Refresh Token",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/coder-before-2.23.0-session-expiration-bypass-via-oidc-without-refresh-token"
}
],
"title": "Coder before 2.23.0 Session Expiration Bypass via OIDC Without Refresh Token",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2025-71435",
"datePublished": "2026-10-17T18:46:07.735Z",
"dateReserved": "2026-10-17T12:21:54.730Z",
"dateUpdated": "2026-10-19T14:40:10.199Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-58398 (GCVE-0-2024-58398)
Vulnerability from nvd – Published: 2026-10-17 18:46 – Updated: 2026-10-21 21:34
VLAI
EPSS
VEX
Title
Coder 2.3.1 before 2.16.1 Open Redirect via Login Page redirect Parameter
Summary
Coder 2.3.1 before 2.14.4, 2.15.x before 2.15.3, and 2.16.0 before 2.16.1 contains an open redirect vulnerability in the login page because the redirect query parameter is improperly sanitized. Attackers can craft a Coder login URL that, when clicked by a logged-in user, redirects the victim to an attacker-controlled website for phishing.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-21 21:34 UTC
CWE
- CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/coder/coder/security/advisorie… | vendor-advisory |
| https://github.com/coder/coder/commit/69c1d981e31… | patch |
| https://www.vulncheck.com/advisories/coder-2.3.1-… | third-party-advisory |
Impacted products
Date Public
2024-10-28 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-58398",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-21T21:34:49.806627Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T21:34:59.156Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/coder/coder/v2",
"product": "coder",
"vendor": "coder",
"versions": [
{
"lessThan": "2.16.1",
"status": "affected",
"version": "2.16.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.16.1",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/coder/coder/v2",
"product": "coder",
"vendor": "coder",
"versions": [
{
"lessThan": "2.15.3",
"status": "affected",
"version": "2.15.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.15.3",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/coder/coder/v2",
"product": "coder",
"vendor": "coder",
"versions": [
{
"lessThan": "2.14.4",
"status": "affected",
"version": "2.3.1",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.14.4",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.16.1",
"versionStartIncluding": "2.16.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.15.3",
"versionStartIncluding": "2.15.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.14.4",
"versionStartIncluding": "2.3.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.15.3",
"versionStartIncluding": "2.15.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.14.4",
"versionStartIncluding": "2.3.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "jchristov"
}
],
"datePublic": "2024-10-28T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Coder 2.3.1 before 2.14.4, 2.15.x before 2.15.3, and 2.16.0 before 2.16.1 contains an open redirect vulnerability in the login page because the redirect query parameter is improperly sanitized. Attackers can craft a Coder login URL that, when clicked by a logged-in user, redirects the victim to an attacker-controlled website for phishing."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-601",
"description": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-17T18:46:07.073Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-wcx9-ccpj-hx3c)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/coder/coder/security/advisories/GHSA-wcx9-ccpj-hx3c"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/coder/coder/commit/69c1d981e3131e50d52b01f6a360abadaad699e6"
},
{
"name": "VulnCheck Advisory: Coder 2.3.1 before 2.16.1 Open Redirect via Login Page redirect Parameter",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/coder-2.3.1-before-2.16.1-open-redirect-via-login-page-redirect-parameter"
}
],
"title": "Coder 2.3.1 before 2.16.1 Open Redirect via Login Page redirect Parameter",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2024-58398",
"datePublished": "2026-10-17T18:46:07.073Z",
"dateReserved": "2026-10-17T12:21:59.408Z",
"dateUpdated": "2026-10-21T21:34:59.156Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-126308 (GCVE-0-2026-126308)
Vulnerability from cvelistv5 – Published: 2026-11-13 09:36 – Updated: 2026-11-13 09:36
VLAI
EPSS
VEX
Title
Coder 2.38.0 before 2.38.2 Session Token Leak via Sub-Agent External Apps
Summary
The web dashboard in Coder 2.24.0 before 2.29.23, 2.30.0 before 2.34.14, 2.35.0 before 2.36.9, 2.37.0 before 2.37.6, and 2.38.0 before 2.38.2 replaces the $SESSION_TOKEN placeholder in external app URLs with a full-access API key without checking whether the app belongs to a sub-agent. Code running in a workspace can register a disguised sub-agent app with a custom protocol URL, so the owner's click sends their API key to an attacker-chosen destination.
Severity
CWE
- CWE-201 - Insertion of Sensitive Information Into Sent Data
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/coder/coder/security/advisorie… | vendor-advisory |
| https://www.vulncheck.com/advisories/coder-2.38.0… | third-party-advisory |
Impacted products
6 products
| Vendor | Product | Version | |
|---|---|---|---|
| coder | coder |
Affected:
2.38.0 , < 2.38.2
(semver)
Unaffected: 2.38.2 (semver) |
|
| coder | coder |
Affected:
2.37.0 , < 2.37.6
(semver)
Unaffected: 2.37.6 (semver) |
|
| coder | coder |
Affected:
2.36.0 , < 2.36.9
(semver)
Unaffected: 2.36.9 (semver) |
|
| coder | coder |
Affected:
2.30.0 , < 2.34.14
(semver)
Unaffected: 2.34.14 (semver) |
|
| coder | coder |
Affected:
2.24.0 , < 2.29.23
(semver)
Unaffected: 2.29.23 (semver) |
|
| coder | coder |
Affected:
2.35.0 , < 2.36.0
(semver)
Unaffected: 2.36.0 (semver) |
Date Public
2026-10-27 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/coder/coder/v2",
"product": "coder",
"vendor": "coder",
"versions": [
{
"lessThan": "2.38.2",
"status": "affected",
"version": "2.38.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.38.2",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/coder/coder/v2",
"product": "coder",
"vendor": "coder",
"versions": [
{
"lessThan": "2.37.6",
"status": "affected",
"version": "2.37.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.37.6",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/coder/coder/v2",
"product": "coder",
"vendor": "coder",
"versions": [
{
"lessThan": "2.36.9",
"status": "affected",
"version": "2.36.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.36.9",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/coder/coder/v2",
"product": "coder",
"vendor": "coder",
"versions": [
{
"lessThan": "2.34.14",
"status": "affected",
"version": "2.30.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.34.14",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/coder/coder/v2",
"product": "coder",
"vendor": "coder",
"versions": [
{
"lessThan": "2.29.23",
"status": "affected",
"version": "2.24.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.29.23",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/coder/coder/v2",
"product": "coder",
"vendor": "coder",
"versions": [
{
"lessThan": "2.36.0",
"status": "affected",
"version": "2.35.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.36.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.38.2",
"versionStartIncluding": "2.38.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.37.6",
"versionStartIncluding": "2.37.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.36.9",
"versionStartIncluding": "2.36.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.34.14",
"versionStartIncluding": "2.30.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.29.23",
"versionStartIncluding": "2.24.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.36.0",
"versionStartIncluding": "2.35.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "manus-pi"
},
{
"lang": "en",
"type": "remediation developer",
"value": "EhabY"
}
],
"datePublic": "2026-10-27T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The web dashboard in Coder 2.24.0 before 2.29.23, 2.30.0 before 2.34.14, 2.35.0 before 2.36.9, 2.37.0 before 2.37.6, and 2.38.0 before 2.38.2 replaces the $SESSION_TOKEN placeholder in external app URLs with a full-access API key without checking whether the app belongs to a sub-agent. Code running in a workspace can register a disguised sub-agent app with a custom protocol URL, so the owner\u0027s click sends their API key to an attacker-chosen destination."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-201",
"description": "Insertion of Sensitive Information Into Sent Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T09:36:20.400Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-2x8w-q434-f76p)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/coder/coder/security/advisories/GHSA-2x8w-q434-f76p"
},
{
"name": "VulnCheck Advisory: Coder 2.38.0 before 2.38.2 Session Token Leak via Sub-Agent External Apps",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/coder-2.38.0-before-2.38.2-session-token-leak-via-sub-agent-external-apps"
}
],
"title": "Coder 2.38.0 before 2.38.2 Session Token Leak via Sub-Agent External Apps",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-126308",
"datePublished": "2026-11-13T09:36:20.400Z",
"dateReserved": "2026-11-10T20:16:44.443Z",
"dateUpdated": "2026-11-13T09:36:20.400Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-126403 (GCVE-0-2026-126403)
Vulnerability from cvelistv5 – Published: 2026-11-13 09:35 – Updated: 2026-11-13 15:55
VLAI
EPSS
VEX
Title
Coder 2.38.0 before 2.38.4 Authorization Bypass via External Agent Credentials Endpoint
Summary
Coder 2.26.0 before 2.29.24, 2.30.0 before 2.34.16, 2.35.0 before 2.36.11, 2.37.0 before 2.37.8, and 2.38.0 before 2.38.4 contains an improper authorization flaw in the external agent credentials endpoint, which returns the workspace agent token to users with only workspace read access rather than ssh permission. Authenticated users with roles such as Template Admin or Organization Admin can use the token to read the owner's private Git SSH key and Git provider OAuth tokens, and impersonate the agent to receive the owner's sessions.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-13 15:35 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/coder/coder/security/advisorie… | vendor-advisory |
| https://www.vulncheck.com/advisories/coder-2.38.0… | third-party-advisory |
Impacted products
6 products
| Vendor | Product | Version | |
|---|---|---|---|
| coder | coder |
Affected:
2.38.0 , < 2.38.4
(semver)
Unaffected: 2.38.4 (semver) |
|
| coder | coder |
Affected:
2.37.0 , < 2.37.8
(semver)
Unaffected: 2.37.8 (semver) |
|
| coder | coder |
Affected:
2.36.0 , < 2.36.11
(semver)
Unaffected: 2.36.11 (semver) |
|
| coder | coder |
Affected:
2.30.0 , < 2.34.16
(semver)
Unaffected: 2.34.16 (semver) |
|
| coder | coder |
Affected:
2.26.0 , < 2.29.24
(semver)
Unaffected: 2.29.24 (semver) |
|
| coder | coder |
Affected:
2.35.0 , < 2.36.0
(semver)
Unaffected: 2.36.0 (semver) |
Date Public
2026-10-29 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-126403",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-13T15:35:23.703298Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T15:55:21.571Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/coder/coder/v2",
"product": "coder",
"vendor": "coder",
"versions": [
{
"lessThan": "2.38.4",
"status": "affected",
"version": "2.38.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.38.4",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/coder/coder/v2",
"product": "coder",
"vendor": "coder",
"versions": [
{
"lessThan": "2.37.8",
"status": "affected",
"version": "2.37.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.37.8",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/coder/coder/v2",
"product": "coder",
"vendor": "coder",
"versions": [
{
"lessThan": "2.36.11",
"status": "affected",
"version": "2.36.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.36.11",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/coder/coder/v2",
"product": "coder",
"vendor": "coder",
"versions": [
{
"lessThan": "2.34.16",
"status": "affected",
"version": "2.30.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.34.16",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/coder/coder/v2",
"product": "coder",
"vendor": "coder",
"versions": [
{
"lessThan": "2.29.24",
"status": "affected",
"version": "2.26.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.29.24",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/coder/coder/v2",
"product": "coder",
"vendor": "coder",
"versions": [
{
"lessThan": "2.36.0",
"status": "affected",
"version": "2.35.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.36.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.38.4",
"versionStartIncluding": "2.38.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.37.8",
"versionStartIncluding": "2.37.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.36.11",
"versionStartIncluding": "2.36.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.34.16",
"versionStartIncluding": "2.30.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.29.24",
"versionStartIncluding": "2.26.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.36.0",
"versionStartIncluding": "2.35.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Habib0x0"
}
],
"datePublic": "2026-10-29T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Coder 2.26.0 before 2.29.24, 2.30.0 before 2.34.16, 2.35.0 before 2.36.11, 2.37.0 before 2.37.8, and 2.38.0 before 2.38.4 contains an improper authorization flaw in the external agent credentials endpoint, which returns the workspace agent token to users with only workspace read access rather than ssh permission. Authenticated users with roles such as Template Admin or Organization Admin can use the token to read the owner\u0027s private Git SSH key and Git provider OAuth tokens, and impersonate the agent to receive the owner\u0027s sessions."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"privilegesRequired": "HIGH",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T09:35:46.335Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-9frj-7f83-x984)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/coder/coder/security/advisories/GHSA-9frj-7f83-x984"
},
{
"name": "VulnCheck Advisory: Coder 2.38.0 before 2.38.4 Authorization Bypass via External Agent Credentials Endpoint",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/coder-2.38.0-before-2.38.4-authorization-bypass-via-external-agent-credentials-endpoint"
}
],
"title": "Coder 2.38.0 before 2.38.4 Authorization Bypass via External Agent Credentials Endpoint",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-126403",
"datePublished": "2026-11-13T09:35:46.335Z",
"dateReserved": "2026-11-10T21:32:21.765Z",
"dateUpdated": "2026-11-13T15:55:21.571Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-126404 (GCVE-0-2026-126404)
Vulnerability from cvelistv5 – Published: 2026-11-13 09:35 – Updated: 2026-11-13 20:26
VLAI
EPSS
VEX
Title
Coder from 2.38.0 before 2.38.4 Privilege Escalation via API Key Creation
Summary
Coder 2.28.0 before 2.29.24, 2.30.0 before 2.34.16, 2.35.0 before 2.36.11, 2.37.0 before 2.37.8, and 2.38.0 before 2.38.4 does not restrict new API keys to the creating token's scopes, allow list, or expiry. A scoped API key or OAuth2 token holding key-creation permission can call POST /api/v2/users/{user}/keys/tokens to mint longer-lived coder:all keys, gaining the user's full privileges.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-13 20:25 UTC
CWE
- CWE-266 - Incorrect Privilege Assignment
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/coder/coder/security/advisorie… | vendor-advisory |
| https://www.vulncheck.com/advisories/coder-from-2… | third-party-advisory |
Impacted products
6 products
| Vendor | Product | Version | |
|---|---|---|---|
| coder | coder |
Affected:
2.38.0 , < 2.38.4
(semver)
Unaffected: 2.38.4 (semver) |
|
| coder | coder |
Affected:
2.37.0 , < 2.37.8
(semver)
Unaffected: 2.37.8 (semver) |
|
| coder | coder |
Affected:
2.36.0 , < 2.36.11
(semver)
Unaffected: 2.36.11 (semver) |
|
| coder | coder |
Affected:
2.30.0 , < 2.34.16
(semver)
Unaffected: 2.34.16 (semver) |
|
| coder | coder |
Affected:
2.28.0 , < 2.29.24
(semver)
Unaffected: 2.29.24 (semver) |
|
| coder | coder |
Affected:
2.35.0 , < 2.36.0
(semver)
Unaffected: 2.36.0 (semver) |
Date Public
2026-10-29 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-126404",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-13T20:25:47.107888Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T20:26:01.693Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/coder/coder/v2",
"product": "coder",
"vendor": "coder",
"versions": [
{
"lessThan": "2.38.4",
"status": "affected",
"version": "2.38.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.38.4",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/coder/coder/v2",
"product": "coder",
"vendor": "coder",
"versions": [
{
"lessThan": "2.37.8",
"status": "affected",
"version": "2.37.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.37.8",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/coder/coder/v2",
"product": "coder",
"vendor": "coder",
"versions": [
{
"lessThan": "2.36.11",
"status": "affected",
"version": "2.36.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.36.11",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/coder/coder/v2",
"product": "coder",
"vendor": "coder",
"versions": [
{
"lessThan": "2.34.16",
"status": "affected",
"version": "2.30.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.34.16",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/coder/coder/v2",
"product": "coder",
"vendor": "coder",
"versions": [
{
"lessThan": "2.29.24",
"status": "affected",
"version": "2.28.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.29.24",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/coder/coder/v2",
"product": "coder",
"vendor": "coder",
"versions": [
{
"lessThan": "2.36.0",
"status": "affected",
"version": "2.35.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.36.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.38.4",
"versionStartIncluding": "2.38.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.37.8",
"versionStartIncluding": "2.37.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.36.11",
"versionStartIncluding": "2.36.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.34.16",
"versionStartIncluding": "2.30.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.29.24",
"versionStartIncluding": "2.28.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.36.0",
"versionStartIncluding": "2.35.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "MutedCybersecurity"
},
{
"lang": "en",
"type": "remediation developer",
"value": "EhabY"
}
],
"datePublic": "2026-10-29T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Coder 2.28.0 before 2.29.24, 2.30.0 before 2.34.16, 2.35.0 before 2.36.11, 2.37.0 before 2.37.8, and 2.38.0 before 2.38.4 does not restrict new API keys to the creating token\u0027s scopes, allow list, or expiry. A scoped API key or OAuth2 token holding key-creation permission can call POST /api/v2/users/{user}/keys/tokens to mint longer-lived coder:all keys, gaining the user\u0027s full privileges."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-266",
"description": "Incorrect Privilege Assignment",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T09:35:45.631Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-x3gf-xv6p-56hf)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/coder/coder/security/advisories/GHSA-x3gf-xv6p-56hf"
},
{
"name": "VulnCheck Advisory: Coder from 2.38.0 before 2.38.4 Privilege Escalation via API Key Creation",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/coder-from-2.38.0-before-2.38.4-privilege-escalation-via-api-key-creation"
}
],
"title": "Coder from 2.38.0 before 2.38.4 Privilege Escalation via API Key Creation",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-126404",
"datePublished": "2026-11-13T09:35:45.631Z",
"dateReserved": "2026-11-10T21:32:21.765Z",
"dateUpdated": "2026-11-13T20:26:01.693Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-126405 (GCVE-0-2026-126405)
Vulnerability from cvelistv5 – Published: 2026-11-13 09:35 – Updated: 2026-11-13 09:35
VLAI
EPSS
VEX
Title
Coder from 2.38.0 before 2.38.4 Memory Exhaustion DoS via Web Push
Summary
Coder 2.21.0 before 2.29.24, 2.30.0 before 2.34.16, 2.35.0 before 2.36.11, 2.37.0 before 2.37.8, and 2.38.0 before 2.38.4 reads Web Push endpoint responses in webpushSend with io.ReadAll, without a size limit or client timeout. Any authenticated user can register a subscription via POST /api/v2/users/{user}/webpush/subscription pointing to a server returning an endless body, exhausting coderd memory and crashing the API, dashboard, and workspace connections.
Severity
CWE
- CWE-400 - Uncontrolled Resource Consumption
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/coder/coder/security/advisorie… | vendor-advisory |
| https://www.vulncheck.com/advisories/coder-from-2… | third-party-advisory |
Impacted products
6 products
| Vendor | Product | Version | |
|---|---|---|---|
| coder | coder |
Affected:
2.38.0 , < 2.38.4
(semver)
Unaffected: 2.38.4 (semver) |
|
| coder | coder |
Affected:
2.37.0 , < 2.37.8
(semver)
Unaffected: 2.37.8 (semver) |
|
| coder | coder |
Affected:
2.36.0 , < 2.36.11
(semver)
Unaffected: 2.36.11 (semver) |
|
| coder | coder |
Affected:
2.30.0 , < 2.34.16
(semver)
Unaffected: 2.34.16 (semver) |
|
| coder | coder |
Affected:
2.21.0 , < 2.29.24
(semver)
Unaffected: 2.29.24 (semver) |
|
| coder | coder |
Affected:
2.35.0 , < 2.36.0
(semver)
Unaffected: 2.36.0 (semver) |
Date Public
2026-10-29 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/coder/coder/v2",
"product": "coder",
"vendor": "coder",
"versions": [
{
"lessThan": "2.38.4",
"status": "affected",
"version": "2.38.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.38.4",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/coder/coder/v2",
"product": "coder",
"vendor": "coder",
"versions": [
{
"lessThan": "2.37.8",
"status": "affected",
"version": "2.37.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.37.8",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/coder/coder/v2",
"product": "coder",
"vendor": "coder",
"versions": [
{
"lessThan": "2.36.11",
"status": "affected",
"version": "2.36.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.36.11",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/coder/coder/v2",
"product": "coder",
"vendor": "coder",
"versions": [
{
"lessThan": "2.34.16",
"status": "affected",
"version": "2.30.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.34.16",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/coder/coder/v2",
"product": "coder",
"vendor": "coder",
"versions": [
{
"lessThan": "2.29.24",
"status": "affected",
"version": "2.21.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.29.24",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/coder/coder/v2",
"product": "coder",
"vendor": "coder",
"versions": [
{
"lessThan": "2.36.0",
"status": "affected",
"version": "2.35.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.36.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.38.4",
"versionStartIncluding": "2.38.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.37.8",
"versionStartIncluding": "2.37.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.36.11",
"versionStartIncluding": "2.36.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.34.16",
"versionStartIncluding": "2.30.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.29.24",
"versionStartIncluding": "2.21.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.36.0",
"versionStartIncluding": "2.35.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "remediation developer",
"value": "BobbyHo"
}
],
"datePublic": "2026-10-29T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Coder 2.21.0 before 2.29.24, 2.30.0 before 2.34.16, 2.35.0 before 2.36.11, 2.37.0 before 2.37.8, and 2.38.0 before 2.38.4 reads Web Push endpoint responses in webpushSend with io.ReadAll, without a size limit or client timeout. Any authenticated user can register a subscription via POST /api/v2/users/{user}/webpush/subscription pointing to a server returning an endless body, exhausting coderd memory and crashing the API, dashboard, and workspace connections."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T09:35:44.966Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-64xh-rgcx-gg65)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/coder/coder/security/advisories/GHSA-64xh-rgcx-gg65"
},
{
"name": "VulnCheck Advisory: Coder from 2.38.0 before 2.38.4 Memory Exhaustion DoS via Web Push",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/coder-from-2.38.0-before-2.38.4-memory-exhaustion-dos-via-web-push"
}
],
"title": "Coder from 2.38.0 before 2.38.4 Memory Exhaustion DoS via Web Push",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-126405",
"datePublished": "2026-11-13T09:35:44.966Z",
"dateReserved": "2026-11-10T21:32:21.765Z",
"dateUpdated": "2026-11-13T09:35:44.966Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-121967 (GCVE-0-2026-121967)
Vulnerability from cvelistv5 – Published: 2026-11-04 15:33 – Updated: 2026-11-04 18:13
VLAI
EPSS
VEX
Title
Coder before 2.29.22, 2.34.13, 2.35.10, 2.36.8, 2.37.5, and 2.38.1 AI Gateway Path Traversal
Summary
Coder 2.28.0 before 2.29.22, 2.30.0 before 2.34.13, 2.35.0 before 2.35.10, 2.36.0 before 2.36.8, 2.37.0 before 2.37.5, and 2.38.0 before 2.38.1 contains a path traversal vulnerability in the AI Gateway passthrough router, which forwards percent-encoded dot segments upstream without rejecting them. Authenticated users can send paths such as %2e%2e or ..%2F under allowlisted prefixes to reach unintended provider endpoints using the deployment's centrally managed provider key.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-04 18:13 UTC
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/coder/coder/security/advisorie… | vendor-advisory |
| https://github.com/coder/coder/pull/30178 | patchissue-tracking |
| https://www.vulncheck.com/advisories/coder-before… | third-party-advisory |
Impacted products
6 products
| Vendor | Product | Version | |
|---|---|---|---|
| coder | coder |
Affected:
2.37.0 , < 2.37.5
(semver)
Unaffected: 2.37.5 (semver) |
|
| coder | coder |
Affected:
2.36.0 , < 2.36.8
(semver)
Unaffected: 2.36.8 (semver) |
|
| coder | coder |
Affected:
2.35.0 , < 2.35.10
(semver)
Unaffected: 2.35.10 (semver) |
|
| coder | coder |
Affected:
2.30.0 , < 2.34.13
(semver)
Unaffected: 2.34.13 (semver) |
|
| coder | coder |
Affected:
2.28.0 , < 2.29.22
(semver)
Unaffected: 2.29.22 (semver) |
|
| coder | coder |
Affected:
2.38.0 , < 2.38.1
(semver)
Unaffected: 2.38.1 (semver) |
Date Public
2026-10-21 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-121967",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-04T18:13:18.040579Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T18:13:30.807Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/coder/coder/v2",
"product": "coder",
"vendor": "coder",
"versions": [
{
"lessThan": "2.37.5",
"status": "affected",
"version": "2.37.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.37.5",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/coder/coder/v2",
"product": "coder",
"vendor": "coder",
"versions": [
{
"lessThan": "2.36.8",
"status": "affected",
"version": "2.36.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.36.8",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/coder/coder/v2",
"product": "coder",
"vendor": "coder",
"versions": [
{
"lessThan": "2.35.10",
"status": "affected",
"version": "2.35.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.35.10",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/coder/coder/v2",
"product": "coder",
"vendor": "coder",
"versions": [
{
"lessThan": "2.34.13",
"status": "affected",
"version": "2.30.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.34.13",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/coder/coder/v2",
"product": "coder",
"vendor": "coder",
"versions": [
{
"lessThan": "2.29.22",
"status": "affected",
"version": "2.28.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.29.22",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/coder/coder/v2",
"product": "coder",
"vendor": "coder",
"versions": [
{
"lessThan": "2.38.1",
"status": "affected",
"version": "2.38.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.38.1",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.37.5",
"versionStartIncluding": "2.37.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.36.8",
"versionStartIncluding": "2.36.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.35.10",
"versionStartIncluding": "2.35.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.34.13",
"versionStartIncluding": "2.30.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.29.22",
"versionStartIncluding": "2.28.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.38.1",
"versionStartIncluding": "2.38.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2026-10-21T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Coder 2.28.0 before 2.29.22, 2.30.0 before 2.34.13, 2.35.0 before 2.35.10, 2.36.0 before 2.36.8, 2.37.0 before 2.37.5, and 2.38.0 before 2.38.1 contains a path traversal vulnerability in the AI Gateway passthrough router, which forwards percent-encoded dot segments upstream without rejecting them. Authenticated users can send paths such as %2e%2e or ..%2F under allowlisted prefixes to reach unintended provider endpoints using the deployment\u0027s centrally managed provider key."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 2.3,
"baseSeverity": "LOW",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T15:33:28.808Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-373r-678h-hjc6)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/coder/coder/security/advisories/GHSA-373r-678h-hjc6"
},
{
"name": "GitHub Pull Request #30178",
"tags": [
"patch",
"issue-tracking"
],
"url": "https://github.com/coder/coder/pull/30178"
},
{
"name": "VulnCheck Advisory: Coder before 2.29.22, 2.34.13, 2.35.10, 2.36.8, 2.37.5, and 2.38.1 AI Gateway Path Traversal",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/coder-before-2.29.22-2.34.13-2.35.10-2.36.8-2.37.5-and-2.38.1-ai-gateway-path-traversal"
}
],
"title": "Coder before 2.29.22, 2.34.13, 2.35.10, 2.36.8, 2.37.5, and 2.38.1 AI Gateway Path Traversal",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-121967",
"datePublished": "2026-11-04T15:33:28.808Z",
"dateReserved": "2026-11-04T12:48:39.813Z",
"dateUpdated": "2026-11-04T18:13:30.807Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-118687 (GCVE-0-2026-118687)
Vulnerability from cvelistv5 – Published: 2026-10-28 18:59 – Updated: 2026-10-29 20:54
VLAI
EPSS
VEX
Title
Coder before 2.29.21, 2.34.12, 2.35.9, 2.36.7, and 2.37.4 Missing Audience Validation in GCP Instance-Identity Authentication
Summary
Coder before 2.29.21, 2.30.0 before 2.34.12, 2.35.0 before 2.35.9, 2.36.0 before 2.36.7, and 2.37.0 before 2.37.4 does not validate the audience claim of GCE instance-identity JWTs at the POST /api/v2/workspaceagents/google-instance-identity endpoint. Attackers who obtain an unexpired format=full identity token minted for another relying party can replay it to obtain that workspace agent's session token, which remains valid until the workspace's next build.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-29 15:28 UTC
CWE
- CWE-441 - Unintended Proxy or Intermediary ('Confused Deputy')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/coder/coder/security/advisorie… | vendor-advisory |
| https://www.vulncheck.com/advisories/coder-before… | third-party-advisory |
Impacted products
5 products
| Vendor | Product | Version | |
|---|---|---|---|
| coder | coder |
Affected:
2.37.0 , < 2.37.4
(semver)
Unaffected: 2.37.4 (semver) |
|
| coder | coder |
Affected:
2.36.0 , < 2.36.7
(semver)
Unaffected: 2.36.7 (semver) |
|
| coder | coder |
Affected:
2.35.0 , < 2.35.9
(semver)
Unaffected: 2.35.9 (semver) |
|
| coder | coder |
Affected:
2.30.0 , < 2.34.12
(semver)
Unaffected: 2.34.12 (semver) |
|
| coder | coder |
Affected:
0 , < 2.29.21
(semver)
Unaffected: 2.29.21 (semver) |
Date Public
2026-10-13 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-118687",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-29T15:28:59.226439Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T20:54:16.473Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/coder/coder/v2",
"product": "coder",
"vendor": "coder",
"versions": [
{
"lessThan": "2.37.4",
"status": "affected",
"version": "2.37.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.37.4",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/coder/coder/v2",
"product": "coder",
"vendor": "coder",
"versions": [
{
"lessThan": "2.36.7",
"status": "affected",
"version": "2.36.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.36.7",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/coder/coder/v2",
"product": "coder",
"vendor": "coder",
"versions": [
{
"lessThan": "2.35.9",
"status": "affected",
"version": "2.35.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.35.9",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/coder/coder/v2",
"product": "coder",
"vendor": "coder",
"versions": [
{
"lessThan": "2.34.12",
"status": "affected",
"version": "2.30.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.34.12",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/coder/coder/v2",
"product": "coder",
"vendor": "coder",
"versions": [
{
"lessThan": "2.29.21",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.29.21",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.37.4",
"versionStartIncluding": "2.37.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.36.7",
"versionStartIncluding": "2.36.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.35.9",
"versionStartIncluding": "2.35.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.34.12",
"versionStartIncluding": "2.30.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.29.21",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "matte1782"
}
],
"datePublic": "2026-10-13T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Coder before 2.29.21, 2.30.0 before 2.34.12, 2.35.0 before 2.35.9, 2.36.0 before 2.36.7, and 2.37.0 before 2.37.4 does not validate the audience claim of GCE instance-identity JWTs at the POST /api/v2/workspaceagents/google-instance-identity endpoint. Attackers who obtain an unexpired format=full identity token minted for another relying party can replay it to obtain that workspace agent\u0027s session token, which remains valid until the workspace\u0027s next build."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-441",
"description": "Unintended Proxy or Intermediary (\u0027Confused Deputy\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-28T18:59:56.265Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-24vh-q7rg-243w)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/coder/coder/security/advisories/GHSA-24vh-q7rg-243w"
},
{
"name": "VulnCheck Advisory: Coder before 2.29.21, 2.34.12, 2.35.9, 2.36.7, and 2.37.4 Missing Audience Validation in GCP Instance-Identity Authentication",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/coder-before-2.29.21-2.34.12-2.35.9-2.36.7-and-2.37.4-missing-audience-validation-in-gcp-instance-identity-authentication"
}
],
"title": "Coder before 2.29.21, 2.34.12, 2.35.9, 2.36.7, and 2.37.4 Missing Audience Validation in GCP Instance-Identity Authentication",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-118687",
"datePublished": "2026-10-28T18:59:56.265Z",
"dateReserved": "2026-10-28T17:31:29.498Z",
"dateUpdated": "2026-10-29T20:54:16.473Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111934 (GCVE-0-2026-111934)
Vulnerability from cvelistv5 – Published: 2026-10-17 18:46 – Updated: 2026-10-19 16:39
VLAI
EPSS
VEX
Title
Coder before 2.34.7 IP Spoofing via X-Forwarded-For Header
Summary
Coder before 2.34.7 contains an IP spoofing vulnerability in the ExtractRealIPAddress middleware that trusts the leftmost, client-supplied X-Forwarded-For value instead of the client IP appended by a reverse proxy. Attackers can send forged X-Forwarded-For values through appending proxies to bypass per-IP rate limits on login, one-time passcode, and password validation endpoints, enabling brute-force attacks, and to falsify IP addresses recorded in audit logs.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-19 15:35 UTC
CWE
- CWE-348 - Use of Less Trusted Source
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/coder/coder/security/advisorie… | vendor-advisory |
| https://www.vulncheck.com/advisories/coder-before… | third-party-advisory |
Impacted products
Date Public
2026-08-11 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111934",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T15:35:37.487571Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T16:39:17.593Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/coder/coder/v2",
"product": "coder",
"vendor": "coder",
"versions": [
{
"lessThan": "2.34.7",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.34.7",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.34.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.34.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2026-08-11T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Coder before 2.34.7 contains an IP spoofing vulnerability in the ExtractRealIPAddress middleware that trusts the leftmost, client-supplied X-Forwarded-For value instead of the client IP appended by a reverse proxy. Attackers can send forged X-Forwarded-For values through appending proxies to bypass per-IP rate limits on login, one-time passcode, and password validation endpoints, enabling brute-force attacks, and to falsify IP addresses recorded in audit logs."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.7,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-348",
"description": "Use of Less Trusted Source",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-17T18:46:44.142Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-vprw-xcrv-287h)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/coder/coder/security/advisories/GHSA-vprw-xcrv-287h"
},
{
"name": "VulnCheck Advisory: Coder before 2.34.7 IP Spoofing via X-Forwarded-For Header",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/coder-before-2.34.7-ip-spoofing-via-x-forwarded-for-header"
}
],
"title": "Coder before 2.34.7 IP Spoofing via X-Forwarded-For Header",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-111934",
"datePublished": "2026-10-17T18:46:44.142Z",
"dateReserved": "2026-10-17T12:20:52.372Z",
"dateUpdated": "2026-10-19T16:39:17.593Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111933 (GCVE-0-2026-111933)
Vulnerability from cvelistv5 – Published: 2026-10-17 18:46 – Updated: 2026-10-19 15:12
VLAI
EPSS
VEX
Title
Coder before 2.34.2 User Enumeration via Login Placeholder Hash
Summary
Coder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before 2.34.2 contains a user enumeration vulnerability because userpassword.Compare() substitutes a placeholder hash derived from the string "hunter2" when a stored password hash is empty. Unauthenticated attackers can submit logins with the password "hunter2" and distinguish HTTP 403 from 401 responses to enumerate valid accounts and reveal the authentication provider of SSO-only users.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-19 15:09 UTC
CWE
- CWE-203 - Observable Discrepancy
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/coder/coder/security/advisorie… | vendor-advisory |
| https://www.vulncheck.com/advisories/coder-before… | third-party-advisory |
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| coder | coder |
Affected:
2.34.0 , < 2.34.2
(semver)
Unaffected: 2.34.2 (semver) |
|
| coder | coder |
Affected:
2.33.0 , < 2.33.8
(semver)
Unaffected: 2.33.8 (semver) |
|
| coder | coder |
Affected:
2.30.0 , < 2.32.7
(semver)
Unaffected: 2.32.7 (semver) |
|
| coder | coder |
Affected:
0 , < 2.29.17
(semver)
Unaffected: 2.29.17 (semver) |
Date Public
2026-06-12 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111933",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T15:09:55.562810Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T15:12:57.230Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/coder/coder/v2",
"product": "coder",
"vendor": "coder",
"versions": [
{
"lessThan": "2.34.2",
"status": "affected",
"version": "2.34.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.34.2",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/coder/coder/v2",
"product": "coder",
"vendor": "coder",
"versions": [
{
"lessThan": "2.33.8",
"status": "affected",
"version": "2.33.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.33.8",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/coder/coder/v2",
"product": "coder",
"vendor": "coder",
"versions": [
{
"lessThan": "2.32.7",
"status": "affected",
"version": "2.30.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.32.7",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/coder/coder/v2",
"product": "coder",
"vendor": "coder",
"versions": [
{
"lessThan": "2.29.17",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.29.17",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.34.2",
"versionStartIncluding": "2.34.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.33.8",
"versionStartIncluding": "2.33.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.32.7",
"versionStartIncluding": "2.30.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.29.17",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2026-06-12T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Coder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before 2.34.2 contains a user enumeration vulnerability because userpassword.Compare() substitutes a placeholder hash derived from the string \"hunter2\" when a stored password hash is empty. Unauthenticated attackers can submit logins with the password \"hunter2\" and distinguish HTTP 403 from 401 responses to enumerate valid accounts and reveal the authentication provider of SSO-only users."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.7,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-203",
"description": "Observable Discrepancy",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-17T18:46:43.456Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-8fxq-53rx-ph5f)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/coder/coder/security/advisories/GHSA-8fxq-53rx-ph5f"
},
{
"name": "VulnCheck Advisory: Coder before 2.34.2 User Enumeration via Login Placeholder Hash",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/coder-before-2.34.2-user-enumeration-via-login-placeholder-hash"
}
],
"title": "Coder before 2.34.2 User Enumeration via Login Placeholder Hash",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-111933",
"datePublished": "2026-10-17T18:46:43.456Z",
"dateReserved": "2026-10-17T12:20:52.372Z",
"dateUpdated": "2026-10-19T15:12:57.230Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111932 (GCVE-0-2026-111932)
Vulnerability from cvelistv5 – Published: 2026-10-17 18:46 – Updated: 2026-10-22 02:08
VLAI
EPSS
VEX
Title
Coder before 2.34.2 Stored HTML Injection via Appearance Settings
Summary
Coder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before 2.34.2 contains a stored HTML injection vulnerability because the ApplicationName and LogoURL appearance settings are rendered into HTML output without sufficient escaping. Attackers with the Owner role can store HTML markup in these settings that renders in the Coder dashboard and in SMTP notification emails sent to other deployment users.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-22 02:08 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/coder/coder/security/advisorie… | vendor-advisory |
| https://www.vulncheck.com/advisories/coder-before… | third-party-advisory |
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| coder | coder |
Affected:
2.34.0 , < 2.34.2
(semver)
Unaffected: 2.34.2 (semver) |
|
| coder | coder |
Affected:
2.33.0 , < 2.33.8
(semver)
Unaffected: 2.33.8 (semver) |
|
| coder | coder |
Affected:
2.30.0 , < 2.32.7
(semver)
Unaffected: 2.32.7 (semver) |
|
| coder | coder |
Affected:
0 , < 2.29.17
(semver)
Unaffected: 2.29.17 (semver) |
Date Public
2026-06-12 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111932",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-22T02:08:37.846699Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-22T02:08:49.284Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/coder/coder/v2",
"product": "coder",
"vendor": "coder",
"versions": [
{
"lessThan": "2.34.2",
"status": "affected",
"version": "2.34.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.34.2",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/coder/coder/v2",
"product": "coder",
"vendor": "coder",
"versions": [
{
"lessThan": "2.33.8",
"status": "affected",
"version": "2.33.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.33.8",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/coder/coder/v2",
"product": "coder",
"vendor": "coder",
"versions": [
{
"lessThan": "2.32.7",
"status": "affected",
"version": "2.30.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.32.7",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/coder/coder/v2",
"product": "coder",
"vendor": "coder",
"versions": [
{
"lessThan": "2.29.17",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.29.17",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.34.2",
"versionStartIncluding": "2.34.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.33.8",
"versionStartIncluding": "2.33.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.32.7",
"versionStartIncluding": "2.30.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.29.17",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2026-06-12T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Coder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before 2.34.2 contains a stored HTML injection vulnerability because the ApplicationName and LogoURL appearance settings are rendered into HTML output without sufficient escaping. Attackers with the Owner role can store HTML markup in these settings that renders in the Coder dashboard and in SMTP notification emails sent to other deployment users."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"privilegesRequired": "HIGH",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "LOW",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.4,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-17T18:46:42.757Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-h58c-xccx-75m3)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/coder/coder/security/advisories/GHSA-h58c-xccx-75m3"
},
{
"name": "VulnCheck Advisory: Coder before 2.34.2 Stored HTML Injection via Appearance Settings",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/coder-before-2.34.2-stored-html-injection-via-appearance-settings"
}
],
"title": "Coder before 2.34.2 Stored HTML Injection via Appearance Settings",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-111932",
"datePublished": "2026-10-17T18:46:42.757Z",
"dateReserved": "2026-10-17T12:20:52.372Z",
"dateUpdated": "2026-10-22T02:08:49.284Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111931 (GCVE-0-2026-111931)
Vulnerability from cvelistv5 – Published: 2026-10-17 18:46 – Updated: 2026-10-18 11:42
VLAI
EPSS
VEX
Title
Coder 2.0.0 before 2.34.8 Open Redirect via Workspace App Proxy
Summary
Coder from 2.0.0 before 2.34.8 contains an open redirect vulnerability in handleAPIKeySmuggling that allows attackers to redirect users externally via unsanitized r.URL.Path values. Attackers can craft links on trusted workspace app subdomains with paths beginning with double slashes, which become scheme-relative redirects to attacker sites for phishing.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-18 11:16 UTC
CWE
- CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/coder/coder/security/advisorie… | vendor-advisory |
| https://www.vulncheck.com/advisories/coder-2.0.0-… | third-party-advisory |
Impacted products
Date Public
2026-08-10 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111931",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-18T11:16:07.689897Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-18T11:42:56.130Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/coder/coder/v2",
"product": "coder",
"vendor": "coder",
"versions": [
{
"lessThan": "2.34.8",
"status": "affected",
"version": "2.0.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.34.8",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.34.8",
"versionStartIncluding": "2.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2026-08-10T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Coder from 2.0.0 before 2.34.8 contains an open redirect vulnerability in handleAPIKeySmuggling that allows attackers to redirect users externally via unsanitized r.URL.Path values. Attackers can craft links on trusted workspace app subdomains with paths beginning with double slashes, which become scheme-relative redirects to attacker sites for phishing."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-601",
"description": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-17T18:46:42.064Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-98qx-9p2x-c4wh)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/coder/coder/security/advisories/GHSA-98qx-9p2x-c4wh"
},
{
"name": "VulnCheck Advisory: Coder 2.0.0 before 2.34.8 Open Redirect via Workspace App Proxy",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/coder-2.0.0-before-2.34.8-open-redirect-via-workspace-app-proxy"
}
],
"title": "Coder 2.0.0 before 2.34.8 Open Redirect via Workspace App Proxy",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-111931",
"datePublished": "2026-10-17T18:46:42.064Z",
"dateReserved": "2026-10-17T12:20:52.372Z",
"dateUpdated": "2026-10-18T11:42:56.130Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111930 (GCVE-0-2026-111930)
Vulnerability from cvelistv5 – Published: 2026-10-17 18:46 – Updated: 2026-10-19 21:32
VLAI
EPSS
VEX
Title
Coder from 2.26.0 before 2.34.8 Information Disclosure via Workspace ACL Endpoint
Summary
Coder from 2.26.0 before 2.34.8 contains an incorrect authorization flaw in the GET /api/v2/workspaces/{id}/acl endpoint, which checks only workspace read access and then fetches group members using an elevated system context. Authenticated users granted workspace use access can query the endpoint to harvest group members' emails, login types, status, and last-seen and creation timestamps.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-19 21:32 UTC
CWE
- CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/coder/coder/security/advisorie… | vendor-advisory |
| https://www.vulncheck.com/advisories/coder-from-2… | third-party-advisory |
Impacted products
Date Public
2026-08-10 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111930",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T21:32:23.815680Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T21:32:31.858Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/coder/coder/v2",
"product": "coder",
"vendor": "coder",
"versions": [
{
"lessThan": "2.34.8",
"status": "affected",
"version": "2.26.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.34.8",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.34.8",
"versionStartIncluding": "2.26.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2026-08-10T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Coder from 2.26.0 before 2.34.8 contains an incorrect authorization flaw in the GET /api/v2/workspaces/{id}/acl endpoint, which checks only workspace read access and then fetches group members using an elevated system context. Authenticated users granted workspace use access can query the endpoint to harvest group members\u0027 emails, login types, status, and last-seen and creation timestamps."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-17T18:46:41.399Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-cvrm-2xxr-hpcv)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/coder/coder/security/advisories/GHSA-cvrm-2xxr-hpcv"
},
{
"name": "VulnCheck Advisory: Coder from 2.26.0 before 2.34.8 Information Disclosure via Workspace ACL Endpoint",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/coder-from-2.26.0-before-2.34.8-information-disclosure-via-workspace-acl-endpoint"
}
],
"title": "Coder from 2.26.0 before 2.34.8 Information Disclosure via Workspace ACL Endpoint",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-111930",
"datePublished": "2026-10-17T18:46:41.399Z",
"dateReserved": "2026-10-17T12:20:52.372Z",
"dateUpdated": "2026-10-19T21:32:31.858Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111929 (GCVE-0-2026-111929)
Vulnerability from cvelistv5 – Published: 2026-10-17 18:46 – Updated: 2026-10-19 16:39
VLAI
EPSS
VEX
Title
Coder 2.30.0 before 2.34.8 Cross-Organization File Disclosure via DownloadFile RPC
Summary
Coder from 2.30.0 before 2.34.8 contains an authorization bypass vulnerability in the provisioner daemon DownloadFile gRPC handler that allows authenticated provisioner daemons to download other organizations' cached Terraform module archives. Attackers with an org-scoped provisioner key and a known file UUID can retrieve module source code exposing infrastructure topology or embedded secrets.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-19 15:35 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/coder/coder/security/advisorie… | vendor-advisory |
| https://www.vulncheck.com/advisories/coder-2.30.0… | third-party-advisory |
Impacted products
Date Public
2026-08-10 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111929",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T15:35:36.030783Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T16:39:24.356Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/coder/coder/v2",
"product": "coder",
"vendor": "coder",
"versions": [
{
"lessThan": "2.34.8",
"status": "affected",
"version": "2.30.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.34.8",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.34.8",
"versionStartIncluding": "2.30.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2026-08-10T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Coder from 2.30.0 before 2.34.8 contains an authorization bypass vulnerability in the provisioner daemon DownloadFile gRPC handler that allows authenticated provisioner daemons to download other organizations\u0027 cached Terraform module archives. Attackers with an org-scoped provisioner key and a known file UUID can retrieve module source code exposing infrastructure topology or embedded secrets."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "HIGH",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-17T18:46:40.707Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-hrhj-hpwc-9hmc)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/coder/coder/security/advisories/GHSA-hrhj-hpwc-9hmc"
},
{
"name": "VulnCheck Advisory: Coder 2.30.0 before 2.34.8 Cross-Organization File Disclosure via DownloadFile RPC",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/coder-2.30.0-before-2.34.8-cross-organization-file-disclosure-via-downloadfile-rpc"
}
],
"title": "Coder 2.30.0 before 2.34.8 Cross-Organization File Disclosure via DownloadFile RPC",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-111929",
"datePublished": "2026-10-17T18:46:40.707Z",
"dateReserved": "2026-10-17T12:19:42.359Z",
"dateUpdated": "2026-10-19T16:39:24.356Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111928 (GCVE-0-2026-111928)
Vulnerability from cvelistv5 – Published: 2026-10-17 18:46 – Updated: 2026-10-19 15:03
VLAI
EPSS
VEX
Title
Coder 2.0.0 before 2.34.8 Authorization Bypass via User-Level ACL in RBAC Policy
Summary
Coder from 2.0.0 before 2.34.8 contains an incorrect authorization vulnerability in the acl_allow rule of coderd/rbac/policy.rego, which does not verify organization membership for per-user ACL entries, and organization member removal does not scrub those entries. Authenticated users removed from an organization can keep accessing previously granted org-scoped resources such as templates and workspaces via the API.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-19 15:02 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/coder/coder/security/advisorie… | vendor-advisory |
| https://www.vulncheck.com/advisories/coder-2.0.0-… | third-party-advisory |
Impacted products
Date Public
2026-08-10 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111928",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T15:02:13.942781Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T15:03:05.568Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/coder/coder/v2",
"product": "coder",
"vendor": "coder",
"versions": [
{
"lessThan": "2.34.8",
"status": "affected",
"version": "2.0.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.34.8",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.34.8",
"versionStartIncluding": "2.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2026-08-10T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Coder from 2.0.0 before 2.34.8 contains an incorrect authorization vulnerability in the acl_allow rule of coderd/rbac/policy.rego, which does not verify organization membership for per-user ACL entries, and organization member removal does not scrub those entries. Authenticated users removed from an organization can keep accessing previously granted org-scoped resources such as templates and workspaces via the API."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-17T18:46:40.029Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-7v78-w67v-pm2g)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/coder/coder/security/advisories/GHSA-7v78-w67v-pm2g"
},
{
"name": "VulnCheck Advisory: Coder 2.0.0 before 2.34.8 Authorization Bypass via User-Level ACL in RBAC Policy",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/coder-2.0.0-before-2.34.8-authorization-bypass-via-user-level-acl-in-rbac-policy"
}
],
"title": "Coder 2.0.0 before 2.34.8 Authorization Bypass via User-Level ACL in RBAC Policy",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-111928",
"datePublished": "2026-10-17T18:46:40.029Z",
"dateReserved": "2026-10-17T12:19:42.359Z",
"dateUpdated": "2026-10-19T15:03:05.568Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}