---
id: "CVE-2026-111929"
kind: "vulnerability"
aliases: ["CVE-2026-111929"]
title: "Coder: provisioner daemons can download other organizations' cached Terraform modules"
severity: "medium"
cvss: 6.0
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["coder", "multi-tenant", "other", "self-hosted", "terraform"]
not_affected_if: ["default-config", "single-organization"]
published_at: "2026-10-17T19:16:35+00:00"
first_seen_at: "2026-10-23T21:57:14+00:00"
updated_at: "2026-10-25T04:05:50+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111929", "first_seen_at": "2026-10-23T21:57:14+00:00"}]
---

# Coder: provisioner daemons can download other organizations' cached Terraform modules

Coder's provisioner daemon DownloadFile gRPC handler does not check organization boundaries, so an authenticated daemon can fetch cached Terraform module archives belonging to other organizations. An attacker holding an org-scoped provisioner key and a known file UUID can read module source that may expose infrastructure layout or embedded secrets.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the running Coder version with `coder version`; affected builds are from `2.30.0` up to but not including `2.34.8`
- Review who holds provisioner keys for each organization and whether multiple organizations share one Coder deployment

## Fix

- Upgrade Coder to `2.34.8` or later
- Rotate provisioner daemon keys in any organization where an untrusted party may have held one

## Timeline

- 2026-10-23T21:57:14+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111929

## From the sources

Coder from 2.30.0 before 2.34.8 contains an authorization bypass vulnerability in the provisioner daemon DownloadFile gRPC handler that allows authenticated provisioner daemons to download other organizations' cached Terraform module archives. Attackers with an org-scoped provisioner key and a known file UUID can retrieve module source code exposing infrastructure topology or embedded secrets.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_