CVE-2026-111929: Coder 2.30.0 before 2.34.8 Cross-Organization File Disclosure via DownloadFile RPC
Coder from 2.30.0 before 2.34.8 contains an authorization bypass vulnerability in the provisioner daemon DownloadFile gRPC handler that allows authenticated provisioner daemons to download other organizations' cached Terraform module archives. Attackers with an org-scoped provisioner key and a known file UUID can retrieve module source code exposing infrastructure topology or embedded secrets.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Coder deployments running versions from 2.30.0 before 2.34.8 are affected. Exploitation concerns cached Terraform module archives belonging to other organizations.
What does an attacker need to exploit it?
The attacker needs authenticated access through an organization-scoped provisioner key and knowledge of the target cached file's UUID. The attack targets the provisioner daemon DownloadFile gRPC handler.
What data could be disclosed?
An attacker may retrieve Terraform module source code cached for another organization. The disclosed source can reveal infrastructure topology or embedded secrets.