Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

coder — Vulnerabilities & Security Advisories 37

All 37 CVE vulnerabilities found in coder, with AI-generated Chinese analysis, references, and POCs.

This page documents security vulnerabilities for the open-source code editor vendor Coder, categorized by Common Weakness Enumeration tags and associated CVE identifiers. It aggregates known security issues affecting Coder deployments, covering advisory data released from January 2020 through the present date. Here, you can track a vendor’s public advisories, understand a specific weakness class such as cross-site scripting or privilege escalation, and look up a product’s historical vulnerability timeline to assess risk exposure. The collection includes details on affected versions, severity scores, and resolution statuses provided by official channels and third-party researchers. This resource is designed for security engineers and IT administrators who need to audit Coder instances for compliance and remediation planning. By reviewing the aggregated data, users can identify patterns in vulnerability reporting and prioritize patching efforts based on the age and impact of each issue. The content is updated regularly as new disclosures emerge or existing records are refined with additional technical details. All entries are linked to their original source advisories for further verification. This summary serves as a reference point for integrating Coder security data into broader enterprise risk management workflows.

Vendor: coder

CVE ID Title CVSS Severity Published
CVE-2026-121967 Coder before 2.29.22, 2.34.13, 2.35.10, 2.36.8, 2.37.5, and 2.38.1 AI Gateway Path Traversal CWE-22 4.9 Medium 2026-11-04
CVE-2026-118687 Coder before 2.29.21, 2.34.12, 2.35.9, 2.36.7, and 2.37.4 Missing Audience Validation in GCP Instance-Identity Authentication CWE-441 6.5 Medium 2026-10-28
CVE-2026-111934 Coder before 2.34.7 IP Spoofing via X-Forwarded-For Header CWE-348 3.7 Low 2026-10-17
CVE-2026-111933 Coder before 2.34.2 User Enumeration via Login Placeholder Hash CWE-203 3.7 Low 2026-10-17
CVE-2026-111932 Coder before 2.34.2 Stored HTML Injection via Appearance Settings CWE-79 3.4 Low 2026-10-17
CVE-2026-111931 Coder 2.0.0 before 2.34.8 Open Redirect via Workspace App Proxy CWE-601 4.3 Medium 2026-10-17
CVE-2026-111929 Coder 2.30.0 before 2.34.8 Cross-Organization File Disclosure via DownloadFile RPC CWE-863 5.3 Medium 2026-10-17
CVE-2026-111930 Coder from 2.26.0 before 2.34.8 Information Disclosure via Workspace ACL Endpoint CWE-200 4.3 Medium 2026-10-17
CVE-2026-111928 Coder 2.0.0 before 2.34.8 Authorization Bypass via User-Level ACL in RBAC Policy CWE-863 5.4 Medium 2026-10-17
CVE-2026-111926 Coder from 2.10.0 before 2.34.8 Information Disclosure via Agent /debug/manifest CWE-200 3.3 Low 2026-10-17
CVE-2026-111927 Coder before 2.35.4 Credential Theft via Workspace Proxy Hostname Prefix Match CWE-522 7.7 High 2026-10-17
CVE-2025-71435 Coder before 2.23.0 Session Expiration Bypass via OIDC Without Refresh Token CWE-613 4.2 Medium 2026-10-17
CVE-2024-58398 Coder 2.3.1 before 2.16.1 Open Redirect via Login Page redirect Parameter CWE-601 4.3 Medium 2026-10-17
CVE-2026-63443 Coder: Workspace agent API insecure redirect handling allowed cross-agent file read and write CWE-863 8.3 High 2026-09-15
CVE-2026-55438 Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing CWE-346 5.8 Medium 2026-07-08
CVE-2026-55437 Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component CWE-79 5.4 Medium 2026-07-08
CVE-2026-55436 Coder's AI Bridge Proxy skips TLS certificate verification in default configuration CWE-295 7.4 High 2026-07-08
CVE-2026-55433 Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers CWE-862 5.4 Medium 2026-07-08
CVE-2026-55432 Coder's sub-agent app registration bypasses template port-sharing policy enforcement CWE-862 5.4 Medium 2026-07-08
CVE-2026-55431 Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps CWE-522 7.7 High 2026-07-08
CVE-2026-55430 Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access CWE-345 5.8 Medium 2026-07-08
CVE-2026-55429 Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID CWE-639 8.7 High 2026-07-08
CVE-2026-55428 Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator CWE-285 8.2 High 2026-07-07
CVE-2026-55427 Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` CWE-74 8.3 High 2026-07-07
CVE-2026-55079 Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service CWE-789 4.9 Medium 2026-07-07
CVE-2026-55078 Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service CWE-409 6.5 Medium 2026-07-07
CVE-2026-55077 Coder: User-admin role can reset owner account password CWE-285 7.2 High 2026-07-07
CVE-2026-55076 Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking CWE-287 7.4 High 2026-07-07
CVE-2026-55075 Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass CWE-287 7.4 High 2026-07-07
CVE-2026-46354 Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft CWE-347 9.1 Critical 2026-07-07

All 37 known CVE vulnerabilities affecting coder with full Chinese analysis, references, and POCs where available.