{"id":"CVE-2026-111927","kind":"vulnerability","aliases":["CVE-2026-111927"],"related":[],"title":"Coder: hostname check lets prefix domains steal workspace API keys","description":"Coder before 2.29.20, 2.33.0 before 2.33.12, 2.34.0 before 2.34.8, and 2.35.0 before 2.35.4 contains an improper hostname validation flaw in GetWorkspaceProxyByHostname whose SIMILAR TO pattern performs a prefix match, so any domain that is a string prefix of a workspace-proxy access URL is trusted as a proxy. Attackers owning such a domain can lure an authenticated victim to a crafted /api/v2/applications/auth-redirect link, capture the redirected application_connect API key, and replay it to access the victim's workspace apps.","summary":"Coder trusts any domain that starts with a workspace proxy's access URL, so an attacker-owned look-alike domain can receive a victim's application_connect API key. The attacker can then replay that key to reach the victim's workspace apps.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"coder","fixed":["2.35.4","2.34.8","2.33.12","2.29.20"],"affected":">= 2.35.0, < 2.35.4; >= 2.34.0, < 2.34.8; >= 2.33.0, < 2.33.12; < 2.29.20","ecosystem":"go"}],"ecosystems":[],"tags":["api-key","coder","other","self-hosted","workspace-proxy","workspaces"],"not_affected_if":["managed-hosting","no-workspace-proxies","version-already-patched"],"how_to_check":"Run 'coder version' (or check the dashboard footer) on the server: affected if >= 2.35.0 <2.35.4, >= 2.34.0 <2.34.8, >= 2.33.0 <2.33.12, or <2.29.20 (2.30-2.32 are EOL and unpatched). Then run 'coder wsproxy ls' or check Admin > Workspace Proxies: if no workspace proxies are configured, you are not affected.","fix":"Upgrade to 2.35.4, 2.34.8, 2.33.12 or 2.29.20 for your release line. 2.30-2.32 are EOL with no patch, so move to a supported line. There is no config-only workaround.","status":"resolved","published_at":"2026-10-17T19:16:35+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","triaged_at":"2026-10-23T22:37:32+00:00","updated_at":"2026-10-24T00:23:27+00:00","category":"other","confidence":0.9,"triage":{"at":"2026-10-23T22:37:32Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade Coder to 2.29.20, 2.33.12, 2.34.8, or 2.35.4 or later, matching your release line.","reach":"internet","title":"Coder: hostname check lets prefix domains steal workspace API keys","impact":"high","summary":"Coder trusts any domain that starts with a workspace proxy's access URL, so an attacker-owned look-alike domain can receive a victim's application_connect API key. The attacker can then replay that key to reach the victim's workspace apps.","category":"other","who_cares":["coder","self-hosted","workspaces"],"confidence":0.7,"needs_auth":"yes","worst_case":"attacker takes over victim's workspace apps using a stolen API key","analyst_note":"Check whether the victim must be authenticated and whether workspace proxies are required for exposure; confirm affected deployments via the Coder advisory linked from NVD.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["version-already-patched"],"user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000497,"input_tokens":3047,"output_tokens":384,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check whether the victim must be authenticated and whether workspace proxies are required for exposure; confirm affected deployments via the Coder advisory linked from NVD.","search":"'-111927':13A,16A '-2026':12A,15A '/api/v2/applications/auth-redirect':137C '2.29.20':77C '2.33.0':78C '2.33.12':80C '2.34.0':81C '2.34.8':83C '2.35.0':85C '2.35.4':87C 'access':41B,117C,150C 'alik':50B 'api':9A,19B,59B,144C 'api-key':18B 'app':74B,155C 'applic':57B,142C 'attack':46B,62B,124C 'attacker-own':45B 'authent':132C 'captur':139C 'check':3A 'coder':1A,17A,21B,30B,75C 'connect':58B,143C 'contain':88C 'craft':136C 'cve':11A,14A 'domain':6A,33B,51B,106C,128C 'flaw':93C 'getworkspaceproxybyhostnam':95C 'host':25B 'hostnam':2A,91C 'improp':90C 'key':10A,20B,60B,67B,145C 'let':4A 'link':138C 'look':49B 'look-alik':48B 'lure':130C 'match':103C 'own':47B,125C 'pattern':99C 'perform':100C 'prefix':5A,102C,111C 'proxi':28B,39B,116C,123C 'reach':69B 'receiv':53B 'redirect':141C 'replay':65B,147C 'self':24B 'self-host':23B 'similar':97C 'start':35B 'steal':7A 'string':110C 'trust':31B,120C 'url':42B,118C 'valid':92C 'victim':55B,71B,133C,152C 'whose':96C 'workspac':8A,27B,29B,38B,73B,115C,154C 'workspace-proxi':26B,114C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-17T19:16:35+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111927","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111927","severity":null,"published_at":"2026-10-17T19:16:35+00:00","modified_at":"2026-10-21T22:16:48+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-111927:650","url":null,"severity":null,"published_at":"2026-10-24T00:23:27+00:00","modified_at":"2026-10-24T00:23:27+00:00","first_seen_at":"2026-10-24T00:23:27+00:00","fetched_at":"2026-10-24T00:23:27+00:00","note":"Read Coder GHSA-h58h-qvv5-xvwg (published 2026-08-10) and v2.35.4 release. Needs workspace proxies, an authenticated victim who opens a crafted link, and an attacker domain that is a prefix of a proxy URL. No workaround. No PoC or exploitation found; little X chatter."}],"documents":[{"id":2576,"url":"https://github.com/coder/coder/security/advisories/GHSA-h58h-qvv5-xvwg","title":"GHSA-h58h-qvv5-xvwg: Workspace proxy hostname prefix match","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2577,"url":"https://github.com/coder/coder/releases/tag/v2.35.4","title":"Coder v2.35.4","kind":"release","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}