---
id: "CVE-2026-121967"
kind: "vulnerability"
aliases: ["CVE-2026-121967"]
title: "Coder: path traversal in AI Gateway lets users reach unintended provider endpoints"
severity: "medium"
cvss: 4.9
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["ai-gateway", "coder", "runtime", "self-hosted"]
not_affected_if: ["ai-gateway-disabled", "fixed-version"]
published_at: "2026-11-04T16:17:50+00:00"
first_seen_at: "2026-11-04T16:28:15+00:00"
updated_at: "2026-11-04T16:28:59+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121967", "first_seen_at": "2026-11-04T16:28:15+00:00"}]
---

# Coder: path traversal in AI Gateway lets users reach unintended provider endpoints

Coder's AI Gateway passthrough router forwards percent-encoded dot segments such as %2e%2e upstream without rejecting them. An authenticated user can use this to reach provider endpoints outside the allowlist, using the deployment's shared provider key.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Coder version with `coder version` and compare it against the affected ranges in the sources.
- Confirm whether the AI Gateway feature is enabled on the deployment; the sources do not say how to check this setting.

## Fix

- Move to `2.29.22` for the 2.28 line, `2.34.13` for 2.30-2.34, `2.35.10` for 2.35, `2.36.8` for 2.36, `2.37.5` for 2.37, or `2.38.1` for 2.38.

## Timeline

- 2026-11-04T16:28:15+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121967

## Documents

- [advisory] Vendor advisory: github.com https://github.com/coder/coder/security/advisories/GHSA-373r-678h-hjc6
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/coder-before-2.29.22-2.34.13-2.35.10-2.36.8-2.37.5-and-2.38.1-ai-gateway-path-traversal

## From the sources

Coder 2.28.0 before 2.29.22, 2.30.0 before 2.34.13, 2.35.0 before 2.35.10, 2.36.0 before 2.36.8, 2.37.0 before 2.37.5, and 2.38.0 before 2.38.1 contains a path traversal vulnerability in the AI Gateway passthrough router, which forwards percent-encoded dot segments upstream without rejecting them. Authenticated users can send paths such as %2e%2e or ..%2F under allowlisted prefixes to reach unintended provider endpoints using the deployment's centrally managed provider key.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_