{"id":"CVE-2026-126404","kind":"vulnerability","aliases":["CVE-2026-126404"],"related":[],"title":"Coder: scoped API keys can mint unrestricted full-privilege keys","description":"Coder 2.28.0 before 2.29.24, 2.30.0 before 2.34.16, 2.35.0 before 2.36.11, 2.37.0 before 2.37.8, and 2.38.0 before 2.38.4 does not restrict new API keys to the creating token's scopes, allow list, or expiry. A scoped API key or OAuth2 token holding key-creation permission can call POST /api/v2/users/{user}/keys/tokens to mint longer-lived coder:all keys, gaining the user's full privileges.","summary":"Coder does not limit new API keys to the scopes, allow list, or expiry of the token that creates them. A scoped key or OAuth2 token with key-creation permission can call POST /api/v2/users/{user}/keys/tokens to mint longer-lived coder:all keys, gaining the user's full privileges.","severity":"high","cvss":7.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["api-keys","coder","infrastructure","self-hosted"],"not_affected_if":["no-key-creation-scope","patched-version"],"how_to_check":"- Check the Coder server version with `coder version` and compare it to the fixed ranges below.\n- Review which users or OAuth2 clients hold API key-creation permission.","fix":"- Coder 2.29.24 or later for the 2.28 line\n- Coder 2.34.16 or later for the 2.30 line\n- Coder 2.36.11 or later for the 2.35 line\n- Coder 2.37.8 or later for the 2.37 line\n- Coder 2.38.4 or later for the 2.38 line","status":"open","published_at":"2026-11-13T10:17:45+00:00","first_seen_at":"2026-11-13T10:47:19+00:00","triaged_at":"2026-11-13T10:52:41+00:00","updated_at":"2026-11-13T10:52:41+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-11-13T10:52:41Z","model":"claude-haiku-5-5","output":{"fix":"- Coder 2.29.24 or later for the 2.28 line\n- Coder 2.34.16 or later for the 2.30 line\n- Coder 2.36.11 or later for the 2.35 line\n- Coder 2.37.8 or later for the 2.37 line\n- Coder 2.38.4 or later for the 2.38 line","reach":"network","title":"Coder: scoped API keys can mint unrestricted full-privilege keys","impact":"high","summary":"Coder does not limit new API keys to the scopes, allow list, or expiry of the token that creates them. A scoped key or OAuth2 token with key-creation permission can call POST /api/v2/users/{user}/keys/tokens to mint longer-lived coder:all keys, gaining the user's full privileges.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["coder","self-hosted","api-keys"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker gains full user privileges through a longer-lived coder:all key","analyst_note":"","how_to_check":"- Check the Coder server version with `coder version` and compare it to the fixed ranges below.\n- Review which users or OAuth2 clients hold API key-creation permission.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["patched-version","no-key-creation-scope"],"who_is_affected":"Teams that run a self-hosted Coder deployment on an affected version and issue scoped API keys or OAuth2 tokens that include key-creation permission. Deployments on versions outside the listed vulnerable ranges, or where key-creation permission is never granted to scoped tokens, are less exposed. The sources do not say whether managed Coder hosting is affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000793,"input_tokens":4704,"output_tokens":646,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-126404':14A,17A '-2026':13A,16A '/api/v2/users':60B,125C '/keys/tokens':62B,127C '2.28.0':78C '2.29.24':80C '2.30.0':81C '2.34.16':83C '2.35.0':84C '2.36.11':86C '2.37.0':87C '2.37.8':89C '2.38.0':91C '2.38.4':93C 'allow':36B,106C 'api':3A,19B,31B,98C,112C 'api-key':18B 'call':58B,123C 'coder':1A,21B,26B,68B,77C,133C 'creat':44B,102C 'creation':55B,120C 'cve':12A,15A 'expiri':39B,109C 'full':9A,75B,140C 'full-privileg':8A 'gain':71B,136C 'hold':117C 'host':25B 'infrastructur':22B 'key':4A,11A,20B,32B,48B,54B,70B,99C,113C,119C,135C 'key-creat':53B,118C 'limit':29B 'list':37B,107C 'live':67B,132C 'longer':66B,131C 'longer-liv':65B,130C 'mint':6A,64B,129C 'new':30B,97C 'oauth2':50B,115C 'permiss':56B,121C 'post':59B,124C 'privileg':10A,76B,141C 'restrict':96C 'scope':2A,35B,47B,105C,111C 'self':24B 'self-host':23B 'token':42B,51B,103C,116C 'unrestrict':7A 'user':61B,73B,126C,138C","nicknames":[],"mitigations":[],"who_affected":"Teams that run a self-hosted Coder deployment on an affected version and issue scoped API keys or OAuth2 tokens that include key-creation permission. Deployments on versions outside the listed vulnerable ranges, or where key-creation permission is never granted to scoped tokens, are less exposed. The sources do not say whether managed Coder hosting is affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["apikeys","coder","high","infrastructure","selfhosted"],"campaign_type":null,"search_a":"'-126404':14A,17A '-2026':13A,16A 'api':3A 'coder':1A 'cve':12A,15A 'full':9A 'full-privileg':8A 'key':4A,11A 'mint':6A 'privileg':10A 'scope':2A 'unrestrict':7A","search_b":"'/api/v2/users':60B '/keys/tokens':62B 'allow':36B 'api':19B,31B 'api-key':18B 'call':58B 'coder':21B,26B,68B 'creat':44B 'creation':55B 'expiri':39B 'full':75B 'gain':71B 'host':25B 'infrastructur':22B 'key':20B,32B,48B,54B,70B 'key-creat':53B 'limit':29B 'list':37B 'live':67B 'longer':66B 'longer-liv':65B 'mint':64B 'new':30B 'oauth2':50B 'permiss':56B 'post':59B 'privileg':76B 'scope':35B,47B 'self':24B 'self-host':23B 'token':42B,51B 'user':61B,73B","search_c":"'/api/v2/users':125C '/keys/tokens':127C '2.28.0':78C '2.29.24':80C '2.30.0':81C '2.34.16':83C '2.35.0':84C '2.36.11':86C '2.37.0':87C '2.37.8':89C '2.38.0':91C '2.38.4':93C 'allow':106C 'api':98C,112C 'call':123C 'coder':77C,133C 'creat':102C 'creation':120C 'expiri':109C 'full':140C 'gain':136C 'hold':117C 'key':99C,113C,119C,135C 'key-creat':118C 'list':107C 'live':132C 'longer':131C 'longer-liv':130C 'mint':129C 'new':97C 'oauth2':115C 'permiss':121C 'post':124C 'privileg':141C 'restrict':96C 'scope':105C,111C 'token':103C,116C 'user':126C,138C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-29T11:04:52+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126404","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126404","severity":null,"published_at":"2026-11-13T10:17:45+00:00","modified_at":"2026-11-13T10:17:45+00:00","first_seen_at":"2026-11-13T10:47:19+00:00","fetched_at":"2026-11-13T10:47:19+00:00","note":null}],"documents":[{"id":145051,"url":"https://github.com/coder/coder/security/advisories/GHSA-x3gf-xv6p-56hf","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-29T11:04:52+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":145052,"url":"https://www.vulncheck.com/advisories/coder-from-2.38.0-before-2.38.4-privilege-escalation-via-api-key-creation","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}