---
id: "CVE-2026-126404"
page: "https://infrastack.ai/live/CVE-2026-126404"
kind: "vulnerability"
aliases: ["CVE-2026-126404"]
title: "Coder: scoped API keys can mint unrestricted full-privilege keys"
severity: "high"
cvss: 7.6
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["api-keys", "coder", "infrastructure", "self-hosted"]
not_affected_if: ["no-key-creation-scope", "patched-version"]
published_at: "2026-11-13T10:17:45+00:00"
first_seen_at: "2026-11-13T10:47:19+00:00"
updated_at: "2026-11-13T10:52:41+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126404", "first_seen_at": "2026-11-13T10:47:19+00:00"}]
exploit_sources: []
---

# Coder: scoped API keys can mint unrestricted full-privilege keys

Link for people: https://infrastack.ai/live/CVE-2026-126404 (this .md is for agents)

Coder does not limit new API keys to the scopes, allow list, or expiry of the token that creates them. A scoped key or OAuth2 token with key-creation permission can call POST /api/v2/users/{user}/keys/tokens to mint longer-lived coder:all keys, gaining the user's full privileges.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Coder server version with `coder version` and compare it to the fixed ranges below.
- Review which users or OAuth2 clients hold API key-creation permission.

## Fix

- Coder 2.29.24 or later for the 2.28 line
- Coder 2.34.16 or later for the 2.30 line
- Coder 2.36.11 or later for the 2.35 line
- Coder 2.37.8 or later for the 2.37 line
- Coder 2.38.4 or later for the 2.38 line

## Timeline

- 2026-11-13T10:47:19+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126404

## Documents

- [advisory] Vendor advisory: github.com https://github.com/coder/coder/security/advisories/GHSA-x3gf-xv6p-56hf
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/coder-from-2.38.0-before-2.38.4-privilege-escalation-via-api-key-creation

## From the sources

Coder 2.28.0 before 2.29.24, 2.30.0 before 2.34.16, 2.35.0 before 2.36.11, 2.37.0 before 2.37.8, and 2.38.0 before 2.38.4 does not restrict new API keys to the creating token's scopes, allow list, or expiry. A scoped API key or OAuth2 token holding key-creation permission can call POST /api/v2/users/{user}/keys/tokens to mint longer-lived coder:all keys, gaining the user's full privileges.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_