All 37 CVE vulnerabilities found in coder, with AI-generated Chinese analysis, references, and POCs.
This page documents security vulnerabilities for the open-source code editor vendor Coder, categorized by Common Weakness Enumeration tags and associated CVE identifiers. It aggregates known security issues affecting Coder deployments, covering advisory data released from January 2020 through the present date. Here, you can track a vendor’s public advisories, understand a specific weakness class such as cross-site scripting or privilege escalation, and look up a product’s historical vulnerability timeline to assess risk exposure. The collection includes details on affected versions, severity scores, and resolution statuses provided by official channels and third-party researchers. This resource is designed for security engineers and IT administrators who need to audit Coder instances for compliance and remediation planning. By reviewing the aggregated data, users can identify patterns in vulnerability reporting and prioritize patching efforts based on the age and impact of each issue. The content is updated regularly as new disclosures emerge or existing records are refined with additional technical details. All entries are linked to their original source advisories for further verification. This summary serves as a reference point for integrating Coder security data into broader enterprise risk management workflows.
Vendor: coder
| CVE ID | Title | CVSS | Severity | Published |
|---|---|---|---|---|
| CVE-2026-45796 | Coder vulnerable to unauthenticated SSRF via Azure Instance Identity Endpoint CWE-918 | 6.5 | Medium | 2026-07-07 |
| CVE-2026-44454 | Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent CWE-78 | 8.1 | High | 2026-07-07 |
| CVE-2026-55434 | Coder vulnerable to denial of service via unbounded request body in AI Bridge provider endpoints CWE-770 | 6.5 | Medium | 2026-07-07 |
| CVE-2026-55435 | Suspended Coder users retain access to AI Bridge LLM proxy endpoints CWE-863 | 5.4 | Medium | 2026-07-07 |
| CVE-2025-66411 | Coder logged sensitive objects unsanitized CWE-532 | 7.8 | High | 2025-12-03 |
| CVE-2025-58437 | Coder's privilege escalation vulnerability could lead to a cross workspace compromise CWE-613 | 8.1 | High | 2025-09-06 |
| CVE-2024-27918 | Coder's OIDC authentication allows email with partially matching domain to register CWE-20 | 8.2 | High | 2024-03-06 |
All 37 known CVE vulnerabilities affecting coder with full Chinese analysis, references, and POCs where available.