All vulnerabilities
CVE-2026-111927GHSA-h58h-qvv5-xvwg

Coder before 2.35.4 Credential Theft via Workspace Proxy Hostname Prefix Match

coder coder
Open in ThreatlineRecord JSON
CVSS
8.7High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.21%Chance of exploitation activity in the next 30 days, higher than 9% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in2.35.4Also 2.34.8, 2.33.12 and 1 moreCVE List
Published17 Oct 2026Updated 21 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Coder before 2.29.20, 2.33.0 before 2.33.12, 2.34.0 before 2.34.8, and 2.35.0 before 2.35.4 contains an improper hostname validation flaw in GetWorkspaceProxyByHostname whose SIMILAR TO pattern performs a prefix match, so any domain that is a string prefix of a workspace-proxy access URL is trusted as a proxy. Attackers owning such a domain can lure an authenticated victim to a crafted /api/v2/applications/auth-redirect link, capture the redirected application_connect API key, and replay it to access the victim's workspace apps.

Text from CVE List

Affected versions 8

  • coderaffected: 2.35.0 before 2.35.4CVE List
  • coderunaffected: 2.35.4CVE List
  • coderaffected: 2.34.0 before 2.34.8CVE List
  • coderunaffected: 2.34.8CVE List
  • coderaffected: 2.33.0 before 2.33.12CVE List
  • coderunaffected: 2.33.12CVE List
  • coderaffected: all versions before 2.29.20CVE List
  • coderunaffected: 2.29.20CVE List

References 2