{"id":"CVE-2026-111929","kind":"vulnerability","aliases":["CVE-2026-111929"],"related":[],"title":"Coder: provisioner daemons can download other organizations' cached Terraform modules","description":"Coder from 2.30.0 before 2.34.8 contains an authorization bypass vulnerability in the provisioner daemon DownloadFile gRPC handler that allows authenticated provisioner daemons to download other organizations' cached Terraform module archives. Attackers with an org-scoped provisioner key and a known file UUID can retrieve module source code exposing infrastructure topology or embedded secrets.","summary":"Coder's provisioner daemon DownloadFile gRPC handler does not check organization boundaries, so an authenticated daemon can fetch cached Terraform module archives belonging to other organizations. An attacker holding an org-scoped provisioner key and a known file UUID can read module source that may expose infrastructure layout or embedded secrets.","severity":"medium","cvss":6.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["coder","multi-tenant","other","self-hosted","terraform"],"not_affected_if":["default-config","single-organization"],"how_to_check":"- Check the running Coder version with `coder version`; affected builds are from `2.30.0` up to but not including `2.34.8`\n- Review who holds provisioner keys for each organization and whether multiple organizations share one Coder deployment","fix":"- Upgrade Coder to `2.34.8` or later\n- Rotate provisioner daemon keys in any organization where an untrusted party may have held one","status":"open","published_at":"2026-10-17T19:16:35+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","triaged_at":"2026-10-25T04:05:50+00:00","updated_at":"2026-10-25T04:05:50+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-10-25T04:05:50Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Coder to `2.34.8` or later\n- Rotate provisioner daemon keys in any organization where an untrusted party may have held one","reach":"network","title":"Coder: provisioner daemons can download other organizations' cached Terraform modules","impact":"medium","summary":"Coder's provisioner daemon DownloadFile gRPC handler does not check organization boundaries, so an authenticated daemon can fetch cached Terraform module archives belonging to other organizations. An attacker holding an org-scoped provisioner key and a known file UUID can read module source that may expose infrastructure layout or embedded secrets.","category":"other","nicknames":[],"who_cares":["coder","self-hosted","terraform","multi-tenant"],"confidence":0.7,"needs_auth":"yes","worst_case":"Cross-organization Terraform module source and any embedded secrets readable by a provisioner key holder","analyst_note":"","how_to_check":"- Check the running Coder version with `coder version`; affected builds are from `2.30.0` up to but not including `2.34.8`\n- Review who holds provisioner keys for each organization and whether multiple organizations share one Coder deployment","needs_analyst":false,"not_affected_if":["default-config","single-organization"],"who_is_affected":"Self-hosted Coder deployments running versions from 2.30.0 up to but not before 2.34.8 that have more than one organization or that issue org-scoped provisioner keys. Single-organization deployments have less exposure, since the flaw is cross-organization access. Teams on managed hosting should confirm with the vendor, since the sources do not say.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000632,"input_tokens":3357,"output_tokens":593,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-111929':13A,16A '-2026':12A,15A '2.30.0':80C '2.34.8':82C 'allow':96C 'archiv':47B,107C 'attack':53B,108C 'authent':40B,97C 'author':85C 'belong':48B 'boundari':37B 'bypass':86C 'cach':8A,44B,104C 'check':35B 'code':125C 'coder':1A,17B,26B,78C 'contain':83C 'cve':11A,14A 'daemon':3A,29B,41B,91C,99C 'download':5A,101C 'downloadfil':30B,92C 'embed':76B,130C 'expos':72B,126C 'fetch':43B 'file':64B,119C 'grpc':31B,93C 'handler':32B,94C 'hold':54B 'host':24B 'infrastructur':73B,127C 'key':60B,115C 'known':63B,118C 'layout':74B 'may':71B 'modul':10A,46B,68B,106C,123C 'multi':19B 'multi-ten':18B 'org':57B,112C 'org-scop':56B,111C 'organ':7A,36B,51B,103C 'provision':2A,28B,59B,90C,98C,114C 'read':67B 'retriev':122C 'scope':58B,113C 'secret':77B,131C 'self':23B 'self-host':22B 'sourc':69B,124C 'tenant':20B 'terraform':9A,25B,45B,105C 'topolog':128C 'uuid':65B,120C 'vulner':87C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted Coder deployments running versions from 2.30.0 up to but not before 2.34.8 that have more than one organization or that issue org-scoped provisioner keys. Single-organization deployments have less exposure, since the flaw is cross-organization access. Teams on managed hosting should confirm with the vendor, since the sources do not say.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-17T19:16:35+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111929","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111929","severity":null,"published_at":"2026-10-17T19:16:35+00:00","modified_at":"2026-10-19T21:02:21+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}