Live › vulnerability › CVE-2026-111929
Go to dashboardCoder's provisioner daemon DownloadFile gRPC handler does not check organization boundaries, so an authenticated daemon can fetch cached Terraform module archives belonging to other organizations. An attacker holding an org-scoped provisioner key and a known file UUID can read module source that may expose infrastructure layout or embedded secrets.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Self-hosted Coder deployments running versions from 2.30.0 up to but not before 2.34.8 that have more than one organization or that issue org-scoped provisioner keys. Single-organization deployments have less exposure, since the flaw is cross-organization access. Teams on managed hosting should confirm with the vendor, since the sources do not say.
No product ranges from the sources yet.
coder version; affected builds are from 2.30.0 up to but not including 2.34.82.34.8 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Coder from 2.30.0 before 2.34.8 contains an authorization bypass vulnerability in the provisioner daemon DownloadFile gRPC handler that allows authenticated provisioner daemons to download other organizations' cached Terraform module archives. Attackers with an org-scoped provisioner key and a known file UUID can retrieve module source code exposing infrastructure topology or embedded secrets.
This page as .md · .json · in your agent: get_signal("CVE-2026-111929")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.