CVE-2026-111934: Coder before 2.34.7 IP Spoofing via X-Forwarded-For Header
Coder before 2.34.7 contains an IP spoofing vulnerability in the ExtractRealIPAddress middleware that trusts the leftmost, client-supplied X-Forwarded-For value instead of the client IP appended by a reverse proxy. Attackers can send forged X-Forwarded-For values through appending proxies to bypass per-IP rate limits on login, one-time passcode, and password validation endpoints, enabling brute-force attacks, and to falsify IP addresses recorded in audit logs.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Coderto a version that resolves this vulnerability.Fixed in 2.34.7
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments of Coder before 2.34.7 that receive requests through reverse proxies which append to the X-Forwarded-For header are exposed. The issue depends on the middleware trusting a client-controlled leftmost header value rather than the proxy-appended client address.
What does an attacker need to exploit it?
An attacker only needs network access to send requests through an appending reverse proxy and can supply forged X-Forwarded-For values. No authentication or user interaction is required, but exploiting rate-limit bypasses requires targeting affected login, one-time passcode, or password validation endpoints.
What is the impact beyond bypassing rate limits?
Forged X-Forwarded-For values can cause audit logs to record false source IP addresses. This can undermine IP-based investigation and attribution for activity routed through the affected proxy path.
How can I determine whether my deployment is affected?
Check whether the Coder version is earlier than 2.34.7 and whether requests reach it through a reverse proxy that appends X-Forwarded-For. In an affected setup, supplying a chosen leftmost X-Forwarded-For value may influence the IP used for rate limiting and audit logging.