Coder vulnerabilities
40 CVEs and advisories name Coder as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-45796Coder vulnerable to unauthenticated SSRF via Azure Instance Identity Endpoint
- CVE-2026-44454Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent
- CVE-2026-55434Coder vulnerable to denial of service via unbounded request body in AI Bridge provider endpoints
- CVE-2026-55435Suspended Coder users retain access to AI Bridge LLM proxy endpoints
- CVE-2026-35454Code Extension Marketplace has a Zip Slip Path Traversal
- CVE-2025-66411Coder logged sensitive objects unsanitized
- CVE-2025-59956AgentAPI exposed user chat history via a DNS rebinding attack
- CVE-2025-58437Coder's privilege escalation vulnerability could lead to a cross workspace compromise
- CVE-2025-47269code-server session cookie can be extracted by having user visit specially crafted proxy URL
- CVE-2024-27918Coder's OIDC authentication allows email with partially matching domain to register