Live › vulnerability › CVE-2026-111934
Go to dashboardCoder before 2.34.7 trusts the leftmost, client-supplied X-Forwarded-For value when deriving the client IP, instead of the address appended by the reverse proxy. An attacker can forge that header to evade per-IP rate limits on login, one-time passcode and password checks, enabling brute force, and to write false IP addresses into audit logs.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running Coder before 2.34.7 behind a reverse proxy or load balancer that appends to X-Forwarded-For are exposed, because the forged leftmost value is trusted for rate limiting and audit logging. Deployments with no proxy in front, or already on 2.34.7 or later, are not affected by this flaw.
No product ranges from the sources yet.
coder version; versions below 2.34.7 are affected.2.34.7 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Coder before 2.34.7 contains an IP spoofing vulnerability in the ExtractRealIPAddress middleware that trusts the leftmost, client-supplied X-Forwarded-For value instead of the client IP appended by a reverse proxy. Attackers can send forged X-Forwarded-For values through appending proxies to bypass per-IP rate limits on login, one-time passcode, and password validation endpoints, enabling brute-force attacks, and to falsify IP addresses recorded in audit logs.
This page as .md · .json · in your agent: get_signal("CVE-2026-111934")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.