Vulnerabilities

TI-2026-40006 CVE-2026-55438 · GHSA-5wg6-jmq2-53pw

Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing

LOW 29

Coder allows organizations to provision remote development environments via Terraform.

CVSS 3.1MEDIUM 6.8 Network Low privileges User interaction EPSS 0.00222 Published 2026-07-08 Fixed in 2.34.2, 2.33.8 +2 CWE-346

TI-2026-40005 CVE-2026-55437 · GHSA-7qw2-f75v-62f7

Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component

LOW 24

Coder allows organizations to provision remote development environments via Terraform.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00316 Published 2026-07-08 Fixed in 2.34.2, 2.33.8 +2 CWE-79

TI-2026-40004 CVE-2026-55436 · GHSA-84rm-42xw-mx52

Coder's AI Bridge Proxy skips TLS certificate verification in default configuration

LOW 34

Coder allows organizations to provision remote development environments via Terraform.

CVSS 3.1HIGH 7.4 Network No auth No interaction EPSS 0.00258 Published 2026-07-08 Fixed in 2.34.2, 2.33.8 +1 CWE-295

TI-2026-40001 CVE-2026-55433 · GHSA-jqj2-x4c5-jfxm

Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers

LOW 25

Coder allows organizations to provision remote development environments via Terraform.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00394 Published 2026-07-08 Fixed in 2.34.2, 2.33.8 +2 CWE-862

TI-2026-40000 CVE-2026-55432 · GHSA-x9qq-2qh5-8rxf

Coder's sub-agent app registration bypasses template port-sharing policy enforcement

LOW 24

Coder allows organizations to provision remote development environments via Terraform.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00315 Published 2026-07-08 Fixed in 2.34.2, 2.33.8 +2 CWE-862

TI-2026-39999 CVE-2026-55431 · GHSA-v54h-cp2w-9x4g

Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps

LOW 36

Coder allows organizations to provision remote development environments via Terraform.

CVSS 3.1HIGH 7.7 Network Low privileges User interaction EPSS 0.00336 Published 2026-07-08 Fixed in 2.34.2, 2.33.8 +2 CWE-522

TI-2026-39998 CVE-2026-55430 · GHSA-5g4w-3vw9-478w

Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access

LOW 29

Coder allows organizations to provision remote development environments via Terraform.

CVSS 3.1MEDIUM 6.8 Network Low privileges User interaction EPSS 0.00208 Published 2026-07-08 Fixed in 2.34.2, 2.33.8 +2 CWE-345

TI-2026-39997 CVE-2026-55429 · GHSA-9rjw-3gwp-f59v

Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID

LOW 38

Coder allows organizations to provision remote development environments via Terraform.

CVSS 3.1HIGH 8.7 Network High privileges No interaction EPSS 0.00508 Published 2026-07-08 Fixed in 2.34.2, 2.33.8 +2 CWE-639

TI-2026-39996 CVE-2026-55428 · GHSA-wrq8-fcv5-8hvp

Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator

LOW 38

Coder allows organizations to provision remote development environments via Terraform.

CVSS 3.1HIGH 8.2 Network Low privileges No interaction EPSS 0.00405 Published 2026-07-07 Fixed in 2.34.2, 2.33.8 +2 CWE-285

TI-2026-39995 CVE-2026-55427 · GHSA-mcqq-fqgf-rxwm

Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh`

LOW 38

Coder allows organizations to provision remote development environments via Terraform.

CVSS 3.1HIGH 8.3 Network No auth User interaction EPSS 0.00466 Published 2026-07-07 Fixed in 2.34.2, 2.33.8 +2 CWE-74

TI-2026-39784 CVE-2026-55079 · GHSA-f962-qm93-mj4c

Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service

LOW 30

Coder allows organizations to provision remote development environments via Terraform.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00611 Published 2026-07-07 Fixed in 2.34.2, 2.33.8 +2 CWE-789

TI-2026-39783 CVE-2026-55078 · GHSA-2mg2-p7r7-g27f

Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service

LOW 30

Coder allows organizations to provision remote development environments via Terraform.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00602 Published 2026-07-07 Fixed in 2.34.2, 2.33.8 +2 CWE-409

TI-2026-39782 CVE-2026-55077 · GHSA-29xf-69gq-m9jx

Coder: User-admin role can reset owner account password

LOW 35

Coder allows organizations to provision remote development environments via Terraform.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00615 Published 2026-07-07 Fixed in 2.34.2, 2.33.8 +2 CWE-285

TI-2026-39781 CVE-2026-55076 · GHSA-75vm-6w67-gwvp

Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking

LOW 33

Coder allows organizations to provision remote development environments via Terraform.

CVSS 3.1HIGH 7.4 Network No auth No interaction EPSS 0.0061 Published 2026-07-07 Fixed in 2.34.2, 2.33.8 +2 CWE-287

TI-2026-39780 CVE-2026-55075 · GHSA-9r87-mvcw-x35f

Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass

LOW 35

Coder allows organizations to provision remote development environments via Terraform.

CVSS 3.1HIGH 7.4 Network No auth No interaction EPSS 0.00479 Published 2026-07-07 Fixed in 2.34.2, 2.33.8 +2 CWE-287

TI-2026-34071 CVE-2026-46354 · GHSA-6x44-w3xg-hqqf

Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft

MEDIUM 47

Coder allows organizations to provision remote development environments via Terraform.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00318 Published 2026-07-07 Fixed in 2.33.3, 2.32.2 +4 CWE-347

TI-2026-33531 CVE-2026-45796 · GHSA-686c-7vgv-v3fx

Coder vulnerable to unauthenticated SSRF via Azure Instance Identity Endpoint

LOW 35

Coder allows organizations to provision remote development environments via Terraform.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.0043 Published 2026-07-07 Fixed in 2.33.3, 2.32.2 +4 CWE-918

TI-2026-32394 CVE-2026-44454 · GHSA-m3cr-vc2j-pm27

Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent

MEDIUM 45

Coder allows organizations to provision remote development environments via Terraform.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.02642 Published 2026-07-07 Fixed in 2.29.7, 2.30.2 CWE-78

TI-2026-40002 CVE-2026-55434 · GHSA-f5vp-w269-392g

Coder vulnerable to denial of service via unbounded request body in AI Bridge provider endpoints

LOW 30

Coder allows organizations to provision remote development environments via Terraform.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00552 Published 2026-07-07 Fixed in 2.34.2, 2.33.8 CWE-770

TI-2026-40003 CVE-2026-55435 · GHSA-wqxv-w64v-5wh6

Suspended Coder users retain access to AI Bridge LLM proxy endpoints

LOW 24

Coder allows organizations to provision remote development environments via Terraform.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00315 Published 2026-07-07 Fixed in 2.34.2, 2.33.8 +1 CWE-863

TI-2025-40847 CVE-2025-66411 · GHSA-jf75-p25m-pw74

Coder logged sensitive objects unsanitized

LOW 34

Coder allows organizations to provision remote development environments via Terraform.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00249 Published 2025-12-03 Fixed in 2.28.4, 2.27.7 +1 CWE-532

TI-2025-36196 CVE-2025-58437 · GHSA-j6xf-jwrj-v5qp

Coder's privilege escalation vulnerability could lead to a cross workspace compromise

LOW 37

Coder allows organizations to provision remote development environments via Terraform.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00412 Published 2025-09-06 Fixed in 2.24.4, 2.25.2 CWE-277

TI-2024-18523 CVE-2024-27918 · GHSA-7cc2-r658-7xpf

Coder's OIDC authentication allows email with partially matching domain to register

MEDIUM 44

Coder allows oragnizations to provision remote development environments via Terraform.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.00965 Published 2024-03-06 Fixed in 2.8.4, 2.7.3 +1 CWE-20

Vulnerabilities

Filters