Coder vulnerabilities
40 CVEs and advisories name Coder as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-121967Coder before 2.29.22, 2.34.13, 2.35.10, 2.36.8, 2.37.5, and 2.38.1 AI Gateway Path Traversal
- CVE-2026-118687Coder before 2.29.21, 2.34.12, 2.35.9, 2.36.7, and 2.37.4 Missing Audience Validation in GCP Instance-Identity Authentication
- CVE-2026-111934Coder before 2.34.7 IP Spoofing via X-Forwarded-For Header
- CVE-2026-111933Coder before 2.34.2 User Enumeration via Login Placeholder Hash
- CVE-2026-111932Coder before 2.34.2 Stored HTML Injection via Appearance Settings
- CVE-2026-111931Coder 2.0.0 before 2.34.8 Open Redirect via Workspace App Proxy
- CVE-2026-111930Coder from 2.26.0 before 2.34.8 Information Disclosure via Workspace ACL Endpoint
- CVE-2026-111929Coder 2.30.0 before 2.34.8 Cross-Organization File Disclosure via DownloadFile RPC
- CVE-2026-111928Coder 2.0.0 before 2.34.8 Authorization Bypass via User-Level ACL in RBAC Policy
- CVE-2026-111927Coder before 2.35.4 Credential Theft via Workspace Proxy Hostname Prefix Match
- CVE-2026-111926Coder from 2.10.0 before 2.34.8 Information Disclosure via Agent /debug/manifest
- CVE-2025-71435Coder before 2.23.0 Session Expiration Bypass via OIDC Without Refresh Token
- CVE-2024-58398Coder 2.3.1 before 2.16.1 Open Redirect via Login Page redirect Parameter
- CVE-2026-63443Coder: Workspace agent API insecure redirect handling allowed cross-agent file read and write
- CVE-2026-55438Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing
- CVE-2026-55437Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component
- CVE-2026-55436Coder's AI Bridge Proxy skips TLS certificate verification in default configuration
- CVE-2026-55433Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers
- CVE-2026-55432Coder's sub-agent app registration bypasses template port-sharing policy enforcement
- CVE-2026-55431Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps
- CVE-2026-55430Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access
- CVE-2026-55429Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID
- CVE-2026-55428Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator
- CVE-2026-55427Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh`
- CVE-2026-55079Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service
- CVE-2026-55078Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service
- CVE-2026-55077Coder: User-admin role can reset owner account password
- CVE-2026-55076Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking
- CVE-2026-55075Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass
- CVE-2026-46354Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft