# cve.now: Coder

The newest entries naming Coder as an affected vendor (up to 200), of 40 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-121967](https://cve.now/CVE-2026-121967.md): Coder before 2.29.22, 2.34.13, 2.35.10, 2.36.8, 2.37.5, and 2.38.1 AI Gateway Path Traversal (CVSS 2.3)
- [CVE-2026-118687](https://cve.now/CVE-2026-118687.md): Coder before 2.29.21, 2.34.12, 2.35.9, 2.36.7, and 2.37.4 Missing Audience Validation in GCP Instance-Identity Authentication (CVSS 8.3)
- [CVE-2026-111934](https://cve.now/CVE-2026-111934.md): Coder before 2.34.7 IP Spoofing via X-Forwarded-For Header (CVSS 6.3)
- [CVE-2026-111933](https://cve.now/CVE-2026-111933.md): Coder before 2.34.2 User Enumeration via Login Placeholder Hash (CVSS 6.3)
- [CVE-2026-111932](https://cve.now/CVE-2026-111932.md): Coder before 2.34.2 Stored HTML Injection via Appearance Settings (CVSS 4.8)
- [CVE-2026-111931](https://cve.now/CVE-2026-111931.md): Coder 2.0.0 before 2.34.8 Open Redirect via Workspace App Proxy (CVSS 5.3)
- [CVE-2026-111930](https://cve.now/CVE-2026-111930.md): Coder from 2.26.0 before 2.34.8 Information Disclosure via Workspace ACL Endpoint (CVSS 5.3)
- [CVE-2026-111929](https://cve.now/CVE-2026-111929.md): Coder 2.30.0 before 2.34.8 Cross-Organization File Disclosure via DownloadFile RPC (CVSS 6.0)
- [CVE-2026-111928](https://cve.now/CVE-2026-111928.md): Coder 2.0.0 before 2.34.8 Authorization Bypass via User-Level ACL in RBAC Policy (CVSS 5.3)
- [CVE-2026-111927](https://cve.now/CVE-2026-111927.md): Coder before 2.35.4 Credential Theft via Workspace Proxy Hostname Prefix Match (CVSS 8.7)
- [CVE-2026-111926](https://cve.now/CVE-2026-111926.md): Coder from 2.10.0 before 2.34.8 Information Disclosure via Agent /debug/manifest (CVSS 4.8)
- [CVE-2025-71435](https://cve.now/CVE-2025-71435.md): Coder before 2.23.0 Session Expiration Bypass via OIDC Without Refresh Token (CVSS 2.3)
- [CVE-2024-58398](https://cve.now/CVE-2024-58398.md): Coder 2.3.1 before 2.16.1 Open Redirect via Login Page redirect Parameter (CVSS 5.3)
- [CVE-2026-63443](https://cve.now/CVE-2026-63443.md): Coder: Workspace agent API insecure redirect handling allowed cross-agent file read and write (CVSS 8.3)
- [CVE-2026-55438](https://cve.now/CVE-2026-55438.md): Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing (CVSS 5.8)
- [CVE-2026-55437](https://cve.now/CVE-2026-55437.md): Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component (CVSS 5.4)
- [CVE-2026-55436](https://cve.now/CVE-2026-55436.md): Coder's AI Bridge Proxy skips TLS certificate verification in default configuration (CVSS 7.4)
- [CVE-2026-55433](https://cve.now/CVE-2026-55433.md): Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers (CVSS 5.4)
- [CVE-2026-55432](https://cve.now/CVE-2026-55432.md): Coder's sub-agent app registration bypasses template port-sharing policy enforcement (CVSS 5.4)
- [CVE-2026-55431](https://cve.now/CVE-2026-55431.md): Coder's session token leaked to arbitrary hosts via \`coder open app\` for external workspace apps (CVSS 7.7)
- [CVE-2026-55430](https://cve.now/CVE-2026-55430.md): Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access (CVSS 5.8)
- [CVE-2026-55429](https://cve.now/CVE-2026-55429.md): Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID (CVSS 8.7)
- [CVE-2026-55428](https://cve.now/CVE-2026-55428.md): Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator (CVSS 8.2)
- [CVE-2026-55427](https://cve.now/CVE-2026-55427.md): Coder vulnerable to SSH config injection via unsanitized server-supplied values in \`coder config-ssh\` (CVSS 8.3)
- [CVE-2026-55079](https://cve.now/CVE-2026-55079.md): Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service (CVSS 4.9)
- [CVE-2026-55078](https://cve.now/CVE-2026-55078.md): Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service (CVSS 6.5)
- [CVE-2026-55077](https://cve.now/CVE-2026-55077.md): Coder: User-admin role can reset owner account password (CVSS 7.2)
- [CVE-2026-55076](https://cve.now/CVE-2026-55076.md): Coder's OIDC email\_verified type coercion bypass enables account takeover via unverified email linking (CVSS 7.4)
- [CVE-2026-55075](https://cve.now/CVE-2026-55075.md): Coder vulnerable to OIDC account takeover via email-based user matching and email\_verified bypass (CVSS 7.4)
- [CVE-2026-46354](https://cve.now/CVE-2026-46354.md): Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft (CVSS 9.1)
- [CVE-2026-45796](https://cve.now/CVE-2026-45796.md): Coder vulnerable to unauthenticated SSRF via Azure Instance Identity Endpoint (CVSS 6.5)
- [CVE-2026-44454](https://cve.now/CVE-2026-44454.md): Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent (CVSS 8.1)
- [CVE-2026-55434](https://cve.now/CVE-2026-55434.md): Coder vulnerable to denial of service via unbounded request body in AI Bridge provider endpoints (CVSS 6.5)
- [CVE-2026-55435](https://cve.now/CVE-2026-55435.md): Suspended Coder users retain access to AI Bridge LLM proxy endpoints (CVSS 5.4)
- [CVE-2026-35454](https://cve.now/CVE-2026-35454.md): Code Extension Marketplace has a Zip Slip Path Traversal (CVSS 8.7)
- [CVE-2025-66411](https://cve.now/CVE-2025-66411.md): Coder logged sensitive objects unsanitized (CVSS 7.8)
- [CVE-2025-59956](https://cve.now/CVE-2025-59956.md): AgentAPI exposed user chat history via a DNS rebinding attack (CVSS 6.5)
- [CVE-2025-58437](https://cve.now/CVE-2025-58437.md): Coder's privilege escalation vulnerability could lead to a cross workspace compromise (CVSS 8.1)
- [CVE-2025-47269](https://cve.now/CVE-2025-47269.md): code-server session cookie can be extracted by having user visit specially crafted proxy URL (CVSS 8.3)
- [CVE-2024-27918](https://cve.now/CVE-2024-27918.md): Coder's OIDC authentication allows email with partially matching domain to register (CVSS 8.2)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/coder
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.