{"id":"CVE-2026-121967","kind":"vulnerability","aliases":["CVE-2026-121967"],"related":[],"title":"Coder: path traversal in AI Gateway lets users reach unintended provider endpoints","description":"Coder 2.28.0 before 2.29.22, 2.30.0 before 2.34.13, 2.35.0 before 2.35.10, 2.36.0 before 2.36.8, 2.37.0 before 2.37.5, and 2.38.0 before 2.38.1 contains a path traversal vulnerability in the AI Gateway passthrough router, which forwards percent-encoded dot segments upstream without rejecting them. Authenticated users can send paths such as %2e%2e or ..%2F under allowlisted prefixes to reach unintended provider endpoints using the deployment's centrally managed provider key.","summary":"Coder's AI Gateway passthrough router forwards percent-encoded dot segments such as %2e%2e upstream without rejecting them. An authenticated user can use this to reach provider endpoints outside the allowlist, using the deployment's shared provider key.","severity":"medium","cvss":4.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-gateway","coder","runtime","self-hosted"],"not_affected_if":["ai-gateway-disabled","fixed-version"],"how_to_check":"- Check the installed Coder version with `coder version` and compare it against the affected ranges in the sources.\n- Confirm whether the AI Gateway feature is enabled on the deployment; the sources do not say how to check this setting.","fix":"- Move to `2.29.22` for the 2.28 line, `2.34.13` for 2.30-2.34, `2.35.10` for 2.35, `2.36.8` for 2.36, `2.37.5` for 2.37, or `2.38.1` for 2.38.","status":"open","published_at":"2026-11-04T16:17:50+00:00","first_seen_at":"2026-11-04T16:28:15+00:00","triaged_at":"2026-11-04T16:28:59+00:00","updated_at":"2026-11-04T16:28:59+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-04T16:28:59Z","model":"claude-haiku-5-5","output":{"fix":"- Move to `2.29.22` for the 2.28 line, `2.34.13` for 2.30-2.34, `2.35.10` for 2.35, `2.36.8` for 2.36, `2.37.5` for 2.37, or `2.38.1` for 2.38.","reach":"network","title":"Coder: path traversal in AI Gateway lets users reach unintended provider endpoints","impact":"medium","summary":"Coder's AI Gateway passthrough router forwards percent-encoded dot segments such as %2e%2e upstream without rejecting them. An authenticated user can use this to reach provider endpoints outside the allowlist, using the deployment's shared provider key.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["coder","self-hosted","ai-gateway"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Authenticated users reach unintended provider endpoints using the shared key","analyst_note":"Confirm whether the AI Gateway is on by default and what the allowlisted prefixes are, using the vendor advisory on github.com and the VulnCheck advisory.","how_to_check":"- Check the installed Coder version with `coder version` and compare it against the affected ranges in the sources.\n- Confirm whether the AI Gateway feature is enabled on the deployment; the sources do not say how to check this setting.","plain_action":"","needs_analyst":true,"not_affected_if":["fixed-version","ai-gateway-disabled"],"who_is_affected":"Deployments of Coder that run the AI Gateway passthrough router and allow authenticated users to make requests through it are exposed. The sources describe the risk as reaching provider endpoints under allowlisted prefixes with the centrally managed provider key, so the flaw matters most where that key is shared. Deployments on fixed versions or without the AI Gateway feature can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000775,"input_tokens":4304,"output_tokens":690,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-121967':15A,18A '-2026':14A,17A '2.28.0':68C '2.29.22':70C '2.30.0':71C '2.34.13':73C '2.35.0':74C '2.35.10':76C '2.36.0':77C '2.36.8':79C '2.37.0':80C '2.37.5':82C '2.38.0':84C '2.38.1':86C '2e':41B,42B,116C,117C '2f':119C 'ai':5A,20B,29B,94C 'ai-gateway':19B 'allowlist':59B,121C 'authent':48B,109C 'central':132C 'coder':1A,22B,27B,67C 'contain':87C 'cve':13A,16A 'deploy':62B,130C 'dot':37B,103C 'encod':36B,102C 'endpoint':12A,56B,127C 'forward':33B,99C 'gateway':6A,21B,30B,95C 'host':26B 'key':66B,135C 'let':7A 'manag':133C 'outsid':57B 'passthrough':31B,96C 'path':2A,89C,113C 'percent':35B,101C 'percent-encod':34B,100C 'prefix':122C 'provid':11A,55B,65B,126C,134C 'reach':9A,54B,124C 'reject':45B,107C 'router':32B,97C 'runtim':23B 'segment':38B,104C 'self':25B 'self-host':24B 'send':112C 'share':64B 'travers':3A,90C 'unintend':10A,125C 'upstream':43B,105C 'use':51B,60B,128C 'user':8A,49B,110C 'vulner':91C 'without':44B,106C","nicknames":[],"mitigations":[],"who_affected":"Deployments of Coder that run the AI Gateway passthrough router and allow authenticated users to make requests through it are exposed. The sources describe the risk as reaching provider endpoints under allowlisted prefixes with the centrally managed provider key, so the flaw matters most where that key is shared. Deployments on fixed versions or without the AI Gateway feature can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["aigateway","coder","medium","runtime","selfhosted"],"campaign_type":null,"first_public_at":"2026-10-21T09:57:51+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121967","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121967","severity":null,"published_at":"2026-11-04T16:17:50+00:00","modified_at":"2026-11-04T16:17:50+00:00","first_seen_at":"2026-11-04T16:28:15+00:00","fetched_at":"2026-11-04T16:28:15+00:00","note":null}],"documents":[{"id":68507,"url":"https://github.com/coder/coder/security/advisories/GHSA-373r-678h-hjc6","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-21T09:57:51+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":68508,"url":"https://www.vulncheck.com/advisories/coder-before-2.29.22-2.34.13-2.35.10-2.36.8-2.37.5-and-2.38.1-ai-gateway-path-traversal","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}