---
id: "CVE-2026-126403"
page: "https://infrastack.ai/live/CVE-2026-126403"
kind: "vulnerability"
aliases: ["CVE-2026-126403"]
title: "Coder: workspace read access exposes agent token and owner's Git keys"
severity: "high"
cvss: 8.5
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["coder", "git", "runtime", "self-hosted", "ssh"]
not_affected_if: ["default-config"]
published_at: "2026-11-13T10:17:44+00:00"
first_seen_at: "2026-11-13T10:47:19+00:00"
updated_at: "2026-11-13T10:50:58+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126403", "first_seen_at": "2026-11-13T10:47:19+00:00"}]
exploit_sources: []
---

# Coder: workspace read access exposes agent token and owner's Git keys

Link for people: https://infrastack.ai/live/CVE-2026-126403 (this .md is for agents)

Coder's external agent credentials endpoint returns the workspace agent token to users who only have workspace read access, not SSH permission. An authenticated user can use that token to read the workspace owner's private Git SSH key and Git provider OAuth tokens, and to impersonate the agent.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the running Coder server version with `coder version` and compare it to the fixed ranges below.
- Review which users hold workspace read access on workspaces owned by other users, including Template Admin and Organization Admin roles.

## Fix

- Coder `2.29.24` for the 2.26.x line
- Coder `2.34.16` for the 2.30.x line
- Coder `2.36.11` for the 2.35.x line
- Coder `2.37.8` for the 2.37.x line
- Coder `2.38.4` for the 2.38.x line

## Timeline

- 2026-11-13T10:47:19+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126403

## Documents

- [advisory] Vendor advisory: github.com https://github.com/coder/coder/security/advisories/GHSA-9frj-7f83-x984
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/coder-2.38.0-before-2.38.4-authorization-bypass-via-external-agent-credentials-endpoint

## From the sources

Coder 2.26.0 before 2.29.24, 2.30.0 before 2.34.16, 2.35.0 before 2.36.11, 2.37.0 before 2.37.8, and 2.38.0 before 2.38.4 contains an improper authorization flaw in the external agent credentials endpoint, which returns the workspace agent token to users with only workspace read access rather than ssh permission. Authenticated users with roles such as Template Admin or Organization Admin can use the token to read the owner's private Git SSH key and Git provider OAuth tokens, and impersonate the agent to receive the owner's sessions.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_