Live › vulnerability › CVE-2026-111926
Go to dashboardCoder agents from 2.10.0 before 2.34.8 run an unauthenticated debug HTTP server on 127.0.0.1:2113. Its /debug/manifest endpoint returns template environment variable values, which can include cloud keys or registry tokens.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running Coder agents in versions from 2.10.0 up to but not including 2.34.8 are exposed. The risk applies when a template passes credentials as environment variables and another local user or process shares the workspace, since any of them can query the local endpoint. Deployments on 2.34.8 or later, or with no secrets in template environment variables, have less exposure.
No product ranges from the sources yet.
coder version on each workspace host or check the Coder server version and confirm it is below 2.34.8.ss -ltnp | grep 2113.2.34.8 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Coder from 2.10.0 before 2.34.8 has an unauthenticated agent debug HTTP server on 127.0.0.1:2113 whose /debug/manifest handler returns the full agent manifest, including template-provided environment variable values. A lower-privileged Unix user or process in the same workspace can query this endpoint to read credentials such as cloud keys or registry tokens.
This page as .md · .json · in your agent: get_signal("CVE-2026-111926")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.