Read the docs
TI-2026-76139 Aliases CVE-2026-111934GHSA-wxhj-4mx9-pqgf

Coder trusts spoofable X-Forwarded-For header, enabling IP spoofing

Priority LOW 27CWE-348Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Coder before 2.34.7 trusts the leftmost X-Forwarded-For value supplied by the client instead of the address appended by a reverse proxy. An unauthenticated remote attacker can send forged X-Forwarded-For values through appending proxies (CWE-348). The forged values bypass per-IP rate limits on login, one-time passcode and password validation endpoints, enabling brute-force attacks and falsified IP addresses in audit logs.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

Coder before 2.34.7 contains an IP spoofing vulnerability in the ExtractRealIPAddress middleware that trusts the leftmost, client-supplied X-Forwarded-For value instead of the client IP appended by a reverse proxy. Attackers can send forged X-Forwarded-For values through appending proxies to bypass per-IP rate limits on login, one-time passcode, and password validation endpoints, enabling brute-force attacks, and to falsify IP addresses recorded in audit logs.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00123 2nd percentileScored 2026-11-07
Fix Fixed coder (coder): 2.34.7

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
codercoderbefore 2.34.72.34.7Patch availableCNA
  • coder Vendorcoder Affected before 2.34.7 Fixed in 2.34.7 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*——coder
  • cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:* Versions — — ·coder

Remediation

Upgrade Coder to version 2.34.7 or later, which fixes this issue.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA coder (coder) Fixed in 2.34.7

Timeline

  1. 2026-10-18 Threatist record created from CVE-2026-111934
  2. 2026-10-18 Alias added: GHSA-wxhj-4mx9-pqgf
  3. 2026-10-18 Priority changed: MEDIUM → LOW
  4. 2026-10-19 CISA SSVC decision points changed

References

Advisory 1

  • TI-2025-29799 code-server session cookie can be extracted by having user visit specially crafted proxy URL CVSS 3.1HIGH 8.3
  • TI-2025-37344 AgentAPI exposed user chat history via a DNS rebinding attack CVSS 3.1MEDIUM 6.5
  • TI-2026-34071 Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft CVSS 3.1CRITICAL 9.1
  • TI-2026-32394 Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent CVSS 3.1HIGH 8.8
  • TI-2026-27585 Code Extension Marketplace has a Zip Slip Path Traversal CVSS 4.0HIGH 8.7
  • TI-2024-18523 Coder's OIDC authentication allows email with partially matching domain to register CVSS 3.1HIGH 8.2
See all 42 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences