Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

coder — Vulnerabilities & Security Advisories 37

All 37 CVE vulnerabilities found in coder, with AI-generated Chinese analysis, references, and POCs.

This page aggregates known security vulnerabilities specifically affecting the Coder development platform, categorized by vendor advisories, product flaws, and common weakness types. The collection encompasses a comprehensive range of issues including remote code execution, authentication bypasses, and privilege escalation risks discovered and disclosed from the product's initial release through the most recent updates. Visitors can utilize this resource to track the vendor's official security advisories, analyze the characteristics of specific weakness classes within the Coder ecosystem, or review the complete historical record of vulnerabilities associated with this product. By centralizing these details, the page provides a clear view of the security posture evolution without requiring users to navigate multiple disparate sources. The data supports security teams in assessing exposure, planning remediation strategies, and understanding the context of each reported flaw. All entries are derived from verified public disclosures and official vendor communications to ensure accuracy and relevance. This consolidated view aids in maintaining a secure deployment environment by highlighting past incidents that may inform future defensive measures. Users seeking to evaluate the risk profile of Coder will find this aggregation essential for thorough security analysis and compliance reporting.

Vendor: coder

CVE ID Title CVSS Severity Published
CVE-2026-121967 Coder before 2.29.22, 2.34.13, 2.35.10, 2.36.8, 2.37.5, and 2.38.1 AI Gateway Path Traversal CWE-22 4.9 Medium 2026-11-04
CVE-2026-118687 Coder before 2.29.21, 2.34.12, 2.35.9, 2.36.7, and 2.37.4 Missing Audience Validation in GCP Instance-Identity Authentication CWE-441 6.5 Medium 2026-10-28
CVE-2026-111934 Coder before 2.34.7 IP Spoofing via X-Forwarded-For Header CWE-348 3.7 Low 2026-10-17
CVE-2026-111933 Coder before 2.34.2 User Enumeration via Login Placeholder Hash CWE-203 3.7 Low 2026-10-17
CVE-2026-111932 Coder before 2.34.2 Stored HTML Injection via Appearance Settings CWE-79 3.4 Low 2026-10-17
CVE-2026-111931 Coder 2.0.0 before 2.34.8 Open Redirect via Workspace App Proxy CWE-601 4.3 Medium 2026-10-17
CVE-2026-111929 Coder 2.30.0 before 2.34.8 Cross-Organization File Disclosure via DownloadFile RPC CWE-863 5.3 Medium 2026-10-17
CVE-2026-111930 Coder from 2.26.0 before 2.34.8 Information Disclosure via Workspace ACL Endpoint CWE-200 4.3 Medium 2026-10-17
CVE-2026-111928 Coder 2.0.0 before 2.34.8 Authorization Bypass via User-Level ACL in RBAC Policy CWE-863 5.4 Medium 2026-10-17
CVE-2026-111926 Coder from 2.10.0 before 2.34.8 Information Disclosure via Agent /debug/manifest CWE-200 3.3 Low 2026-10-17
CVE-2026-111927 Coder before 2.35.4 Credential Theft via Workspace Proxy Hostname Prefix Match CWE-522 7.7 High 2026-10-17
CVE-2025-71435 Coder before 2.23.0 Session Expiration Bypass via OIDC Without Refresh Token CWE-613 4.2 Medium 2026-10-17
CVE-2024-58398 Coder 2.3.1 before 2.16.1 Open Redirect via Login Page redirect Parameter CWE-601 4.3 Medium 2026-10-17
CVE-2026-63443 Coder: Workspace agent API insecure redirect handling allowed cross-agent file read and write CWE-863 8.3 High 2026-09-15
CVE-2026-55438 Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing CWE-346 5.8 Medium 2026-07-08
CVE-2026-55437 Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component CWE-79 5.4 Medium 2026-07-08
CVE-2026-55436 Coder's AI Bridge Proxy skips TLS certificate verification in default configuration CWE-295 7.4 High 2026-07-08
CVE-2026-55433 Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers CWE-862 5.4 Medium 2026-07-08
CVE-2026-55432 Coder's sub-agent app registration bypasses template port-sharing policy enforcement CWE-862 5.4 Medium 2026-07-08
CVE-2026-55431 Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps CWE-522 7.7 High 2026-07-08
CVE-2026-55430 Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access CWE-345 5.8 Medium 2026-07-08
CVE-2026-55429 Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID CWE-639 8.7 High 2026-07-08
CVE-2026-55428 Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator CWE-285 8.2 High 2026-07-07
CVE-2026-55427 Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` CWE-74 8.3 High 2026-07-07
CVE-2026-55079 Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service CWE-789 4.9 Medium 2026-07-07
CVE-2026-55078 Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service CWE-409 6.5 Medium 2026-07-07
CVE-2026-55077 Coder: User-admin role can reset owner account password CWE-285 7.2 High 2026-07-07
CVE-2026-55076 Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking CWE-287 7.4 High 2026-07-07
CVE-2026-55075 Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass CWE-287 7.4 High 2026-07-07
CVE-2026-46354 Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft CWE-347 9.1 Critical 2026-07-07

All 37 known CVE vulnerabilities affecting coder with full Chinese analysis, references, and POCs where available.