CVE-2026-111927: Coder before 2.35.4 Credential Theft via Workspace Proxy Hostname Prefix Match
Coder before 2.29.20, 2.33.0 before 2.33.12, 2.34.0 before 2.34.8, and 2.35.0 before 2.35.4 contains an improper hostname validation flaw in GetWorkspaceProxyByHostname whose SIMILAR TO pattern performs a prefix match, so any domain that is a string prefix of a workspace-proxy access URL is trusted as a proxy. Attackers owning such a domain can lure an authenticated victim to a crafted /api/v2/applications/auth-redirect link, capture the redirected applicationconnect API key, and replay it to access the victim's workspace apps.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Coderto a version that resolves this vulnerability.Fixed in 2.29.20 - Upgrade
Upgrade
Coderto a version that resolves this vulnerability.Fixed in 2.33.12 - Upgrade
Upgrade
Coderto a version that resolves this vulnerability.Fixed in 2.34.8 - Upgrade
Upgrade
Coderto a version that resolves this vulnerability.Fixed in 2.35.4
Event History
Frequently Asked Questions
Which deployments are affected?
Affected releases are Coder before 2.29.20, versions 2.33.0 through before 2.33.12, versions 2.34.0 through before 2.34.8, and versions 2.35.0 through before 2.35.4.
What does an attacker need to exploit this?
The attacker must control a domain whose name is a string prefix of a workspace-proxy access URL and must lure an authenticated victim to a crafted /api/v2/applications/auth-redirect link. Exploitation requires low privileges and user interaction.
What can an attacker obtain and do after exploitation?
An attacker can capture the redirected application_connect API key. They can replay that key to access the victim's workspace applications.
How can I determine whether my instance is exposed?
Check whether the deployed Coder version falls within an affected range. Also review workspace-proxy access URLs for domains where an attacker-controlled hostname could be treated as trusted because it begins with the proxy URL's domain string.