{"id":"CVE-2026-111934","kind":"vulnerability","aliases":["CVE-2026-111934"],"related":[],"title":"Coder: forged X-Forwarded-For bypasses login rate limits and audit IPs","description":"Coder before 2.34.7 contains an IP spoofing vulnerability in the ExtractRealIPAddress middleware that trusts the leftmost, client-supplied X-Forwarded-For value instead of the client IP appended by a reverse proxy. Attackers can send forged X-Forwarded-For values through appending proxies to bypass per-IP rate limits on login, one-time passcode, and password validation endpoints, enabling brute-force attacks, and to falsify IP addresses recorded in audit logs.","summary":"Coder before 2.34.7 trusts the leftmost, client-supplied X-Forwarded-For value when deriving the client IP, instead of the address appended by the reverse proxy. An attacker can forge that header to evade per-IP rate limits on login, one-time passcode and password checks, enabling brute force, and to write false IP addresses into audit logs.","severity":"medium","cvss":6.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["audit-logging","coder","other","reverse-proxy","self-hosted"],"not_affected_if":["no-reverse-proxy","version-2.34.7-or-later"],"how_to_check":"- Check the installed Coder version with `coder version`; versions below `2.34.7` are affected.\n- Check whether Coder sits behind a reverse proxy that appends to X-Forwarded-For, which is the setup where the flaw applies.","fix":"- Upgrade Coder to `2.34.7` or later.\n- Until upgraded, rely on rate limiting at the reverse proxy keyed on the proxy-appended client address, not on the header value sent by the client.","status":"open","published_at":"2026-10-17T19:16:36+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","triaged_at":"2026-10-25T04:01:50+00:00","updated_at":"2026-10-25T04:01:50+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-10-25T04:01:50Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Coder to `2.34.7` or later.\n- Until upgraded, rely on rate limiting at the reverse proxy keyed on the proxy-appended client address, not on the header value sent by the client.","reach":"internet","title":"Coder: forged X-Forwarded-For bypasses login rate limits and audit IPs","impact":"medium","summary":"Coder before 2.34.7 trusts the leftmost, client-supplied X-Forwarded-For value when deriving the client IP, instead of the address appended by the reverse proxy. An attacker can forge that header to evade per-IP rate limits on login, one-time passcode and password checks, enabling brute force, and to write false IP addresses into audit logs.","category":"other","nicknames":[],"who_cares":["coder","self-hosted","reverse-proxy","audit-logging"],"confidence":0.7,"needs_auth":"no","worst_case":"Unlimited login guessing and falsified audit log IP addresses","analyst_note":"","how_to_check":"- Check the installed Coder version with `coder version`; versions below `2.34.7` are affected.\n- Check whether Coder sits behind a reverse proxy that appends to X-Forwarded-For, which is the setup where the flaw applies.","needs_analyst":false,"not_affected_if":["version-2.34.7-or-later","no-reverse-proxy"],"who_is_affected":"Teams running Coder before 2.34.7 behind a reverse proxy or load balancer that appends to X-Forwarded-For are exposed, because the forged leftmost value is trusted for rate limiting and audit logging. Deployments with no proxy in front, or already on 2.34.7 or later, are not affected by this flaw.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000653,"input_tokens":3396,"output_tokens":626,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-111934':16A,19A '-2026':15A,18A '2.34.7':33B,95C 'address':53B,89B,165C 'append':54B,122C,137C 'attack':60B,127C,160C 'audit':12A,21B,91B,168C 'audit-log':20B 'brute':82B,158C 'brute-forc':157C 'bypass':7A,140C 'check':80B 'client':38B,48B,110C,120C 'client-suppli':37B,109C 'coder':1A,23B,31B,93C 'contain':96C 'cve':14A,17A 'deriv':46B 'enabl':81B,156C 'endpoint':155C 'evad':66B 'extractrealipaddress':103C 'fals':87B 'falsifi':163C 'forc':83B,159C 'forg':2A,62B,130C 'forward':5A,42B,114C,133C 'header':64B 'host':30B 'instead':50B,117C 'ip':13A,49B,69B,88B,98C,121C,143C,164C 'leftmost':36B,108C 'limit':10A,71B,145C 'log':22B,92B,169C 'login':8A,73B,147C 'middlewar':104C 'one':75B,149C 'one-tim':74B,148C 'passcod':77B,151C 'password':79B,153C 'per':68B,142C 'per-ip':67B,141C 'proxi':27B,58B,126C,138C 'rate':9A,70B,144C 'record':166C 'revers':26B,57B,125C 'reverse-proxi':25B 'self':29B 'self-host':28B 'send':129C 'spoof':99C 'suppli':39B,111C 'time':76B,150C 'trust':34B,106C 'valid':154C 'valu':44B,116C,135C 'vulner':100C 'write':86B 'x':4A,41B,113C,132C 'x-forwarded-for':3A,40B,112C,131C","nicknames":[],"mitigations":[],"who_affected":"Teams running Coder before 2.34.7 behind a reverse proxy or load balancer that appends to X-Forwarded-For are exposed, because the forged leftmost value is trusted for rate limiting and audit logging. Deployments with no proxy in front, or already on 2.34.7 or later, are not affected by this flaw.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-17T19:16:36+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111934","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111934","severity":null,"published_at":"2026-10-17T19:16:36+00:00","modified_at":"2026-10-19T22:10:00+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}