Live › vulnerability › CVE-2026-111927
Go to dashboardCoder trusts any domain that starts with a workspace proxy's access URL, so an attacker-owned look-alike domain can receive a victim's application_connect API key. The attacker can then replay that key to reach the victim's workspace apps.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|
| coder | go | >= 2.35.0, < 2.35.4; >= 2.34.0, < 2.34.8; >= 2.33.0, < 2.33.12; < 2.29.20 | 2.35.4, 2.34.8, 2.33.12, 2.29.20 |
coder version (or check the dashboard footer) on the server: affected if >= 2.35.0 <2.35.4, >= 2.34.0 <2.34.8, >= 2.33.0 <2.33.12, or <2.29.20 (2.30-2.32 are EOL and unpatched)coder wsproxy ls or check Admin > Workspace Proxies: if no workspace proxies are configured, you are not affected2.35.4, 2.34.8, 2.33.12 or 2.29.20 for your release line. 2.30-2.32 are EOL with no patch, so move to a supported lineEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Coder before 2.29.20, 2.33.0 before 2.33.12, 2.34.0 before 2.34.8, and 2.35.0 before 2.35.4 contains an improper hostname validation flaw in GetWorkspaceProxyByHostname whose SIMILAR TO pattern performs a prefix match, so any domain that is a string prefix of a workspace-proxy access URL is trusted as a proxy. Attackers owning such a domain can lure an authenticated victim to a crafted /api/v2/applications/auth-redirect link, capture the redirected application_connect API key, and replay it to access the victim's workspace apps.
This page as .md · .json · in your agent: get_signal("CVE-2026-111927")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.