{"id":"CVE-2026-126403","kind":"vulnerability","aliases":["CVE-2026-126403"],"related":[],"title":"Coder: workspace read access exposes agent token and owner's Git keys","description":"Coder 2.26.0 before 2.29.24, 2.30.0 before 2.34.16, 2.35.0 before 2.36.11, 2.37.0 before 2.37.8, and 2.38.0 before 2.38.4 contains an improper authorization flaw in the external agent credentials endpoint, which returns the workspace agent token to users with only workspace read access rather than ssh permission. Authenticated users with roles such as Template Admin or Organization Admin can use the token to read the owner's private Git SSH key and Git provider OAuth tokens, and impersonate the agent to receive the owner's sessions.","summary":"Coder's external agent credentials endpoint returns the workspace agent token to users who only have workspace read access, not SSH permission. An authenticated user can use that token to read the workspace owner's private Git SSH key and Git provider OAuth tokens, and to impersonate the agent.","severity":"high","cvss":8.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["coder","git","runtime","self-hosted","ssh"],"not_affected_if":["default-config"],"how_to_check":"- Check the running Coder server version with `coder version` and compare it to the fixed ranges below.\n- Review which users hold workspace read access on workspaces owned by other users, including Template Admin and Organization Admin roles.","fix":"- Coder `2.29.24` for the 2.26.x line\n- Coder `2.34.16` for the 2.30.x line\n- Coder `2.36.11` for the 2.35.x line\n- Coder `2.37.8` for the 2.37.x line\n- Coder `2.38.4` for the 2.38.x line","status":"open","published_at":"2026-11-13T10:17:44+00:00","first_seen_at":"2026-11-13T10:47:19+00:00","triaged_at":"2026-11-13T10:50:58+00:00","updated_at":"2026-11-13T10:50:58+00:00","category":"runtime","confidence":0.8,"triage":{"at":"2026-11-13T10:50:58Z","model":"claude-haiku-5-5","output":{"fix":"- Coder `2.29.24` for the 2.26.x line\n- Coder `2.34.16` for the 2.30.x line\n- Coder `2.36.11` for the 2.35.x line\n- Coder `2.37.8` for the 2.37.x line\n- Coder `2.38.4` for the 2.38.x line","reach":"network","title":"Coder: workspace read access exposes agent token and owner's Git keys","impact":"high","summary":"Coder's external agent credentials endpoint returns the workspace agent token to users who only have workspace read access, not SSH permission. An authenticated user can use that token to read the workspace owner's private Git SSH key and Git provider OAuth tokens, and to impersonate the agent.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["coder","self-hosted","git","ssh"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker reads owner's Git SSH key and OAuth tokens","analyst_note":"","how_to_check":"- Check the running Coder server version with `coder version` and compare it to the fixed ranges below.\n- Review which users hold workspace read access on workspaces owned by other users, including Template Admin and Organization Admin roles.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["default-config"],"who_is_affected":"Teams running self-hosted Coder servers in the affected version ranges are exposed. Any authenticated user with workspace read access to another user's workspace, including Template Admin or Organization Admin roles, can abuse the endpoint. Deployments on the fixed versions or on managed hosting not in these ranges can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00079,"input_tokens":4730,"output_tokens":634,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-126403':15A,18A '-2026':14A,17A '2.26.0':76C '2.29.24':78C '2.30.0':79C '2.34.16':81C '2.35.0':82C '2.36.11':84C '2.37.0':85C '2.37.8':87C '2.38.0':89C '2.38.4':91C 'access':4A,44B,115C 'admin':127C,130C 'agent':6A,29B,35B,74B,100C,107C,152C 'authent':49B,120C 'author':95C 'coder':1A,19B,26B,75C 'contain':92C 'credenti':30B,101C 'cve':13A,16A 'endpoint':31B,102C 'expos':5A 'extern':28B,99C 'flaw':96C 'git':11A,20B,62B,66B,141C,145C 'host':24B 'imperson':72B,150C 'improp':94C 'key':12A,64B,143C 'oauth':68B,147C 'organ':129C 'owner':9A,59B,138C,156C 'permiss':47B,119C 'privat':61B,140C 'provid':67B,146C 'rather':116C 'read':3A,43B,56B,114C,136C 'receiv':154C 'return':32B,104C 'role':123C 'runtim':21B 'self':23B 'self-host':22B 'session':158C 'ssh':25B,46B,63B,118C,142C 'templat':126C 'token':7A,36B,54B,69B,108C,134C,148C 'use':52B,132C 'user':38B,50B,110C,121C 'workspac':2A,34B,42B,58B,106C,113C","nicknames":[],"mitigations":[],"who_affected":"Teams running self-hosted Coder servers in the affected version ranges are exposed. Any authenticated user with workspace read access to another user's workspace, including Template Admin or Organization Admin roles, can abuse the endpoint. Deployments on the fixed versions or on managed hosting not in these ranges can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["coder","git","high","runtime","selfhosted","ssh"],"campaign_type":null,"search_a":"'-126403':15A,18A '-2026':14A,17A 'access':4A 'agent':6A 'coder':1A 'cve':13A,16A 'expos':5A 'git':11A 'key':12A 'owner':9A 'read':3A 'token':7A 'workspac':2A","search_b":"'access':44B 'agent':29B,35B,74B 'authent':49B 'coder':19B,26B 'credenti':30B 'endpoint':31B 'extern':28B 'git':20B,62B,66B 'host':24B 'imperson':72B 'key':64B 'oauth':68B 'owner':59B 'permiss':47B 'privat':61B 'provid':67B 'read':43B,56B 'return':32B 'runtim':21B 'self':23B 'self-host':22B 'ssh':25B,46B,63B 'token':36B,54B,69B 'use':52B 'user':38B,50B 'workspac':34B,42B,58B","search_c":"'2.26.0':76C '2.29.24':78C '2.30.0':79C '2.34.16':81C '2.35.0':82C '2.36.11':84C '2.37.0':85C '2.37.8':87C '2.38.0':89C '2.38.4':91C 'access':115C 'admin':127C,130C 'agent':100C,107C,152C 'authent':120C 'author':95C 'coder':75C 'contain':92C 'credenti':101C 'endpoint':102C 'extern':99C 'flaw':96C 'git':141C,145C 'imperson':150C 'improp':94C 'key':143C 'oauth':147C 'organ':129C 'owner':138C,156C 'permiss':119C 'privat':140C 'provid':146C 'rather':116C 'read':114C,136C 'receiv':154C 'return':104C 'role':123C 'session':158C 'ssh':118C,142C 'templat':126C 'token':108C,134C,148C 'use':132C 'user':110C,121C 'workspac':106C,113C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-29T13:27:36+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126403","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126403","severity":null,"published_at":"2026-11-13T10:17:44+00:00","modified_at":"2026-11-13T10:17:44+00:00","first_seen_at":"2026-11-13T10:47:19+00:00","fetched_at":"2026-11-13T10:47:19+00:00","note":null}],"documents":[{"id":145049,"url":"https://github.com/coder/coder/security/advisories/GHSA-9frj-7f83-x984","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-29T13:27:36+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":145050,"url":"https://www.vulncheck.com/advisories/coder-2.38.0-before-2.38.4-authorization-bypass-via-external-agent-credentials-endpoint","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}