CVE-2026-121967: Coder before 2.29.22, 2.34.13, 2.35.10, 2.36.8, 2.37.5, and 2.38.1 AI Gateway Path Traversal

Published Nov 4, 2026

Updated

Coder 2.28.0 before 2.29.22, 2.30.0 before 2.34.13, 2.35.0 before 2.35.10, 2.36.0 before 2.36.8, 2.37.0 before 2.37.5, and 2.38.0 before 2.38.1 contains a path traversal vulnerability in the AI Gateway passthrough router, which forwards percent-encoded dot segments upstream without rejecting them. Authenticated users can send paths such as %2e%2e or ..%2F under allowlisted prefixes to reach unintended provider endpoints using the deployment's centrally managed provider key.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Coder to a version that resolves this vulnerability.
Fixed in 2.29.22
Upgrade
Upgrade Coder to a version that resolves this vulnerability.
Fixed in 2.34.13
Upgrade
Upgrade Coder to a version that resolves this vulnerability.
Fixed in 2.35.10
Upgrade
Upgrade Coder to a version that resolves this vulnerability.
Fixed in 2.36.8
Upgrade
Upgrade Coder to a version that resolves this vulnerability.
Fixed in 2.37.5
Upgrade
Upgrade Coder to a version that resolves this vulnerability.
Fixed in 2.38.1

Event History

Nov 4, 2026

CVE Published

via MITRE·03:33 PM

Data Sourced

via MITRE·03:33 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·04:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed?

Deployments running Coder 2.28.0 through the affected release ranges are exposed when using the AI Gateway passthrough router. The issue affects the 2.28, 2.30, 2.35, 2.36, 2.37, and 2.38 release lines identified in the advisory.

What access does an attacker need?

An attacker must be an authenticated user. Exploitation does not require user interaction, but requires crafting traversal sequences within paths under allowlisted prefixes.

What could an attacker access through this issue?

The attacker can reach unintended provider endpoints through the AI Gateway passthrough router. Requests are made using the deployment's centrally managed provider key, potentially exposing provider capabilities not intended for that user.

Which releases contain fixes?

Update to Coder 2.29.22, 2.34.13, 2.35.10, 2.36.8, 2.37.5, or 2.38.1, as applicable to the release line in use.

CVE-2026-121967: Coder before 2.29.22, 2.34.13, 2.35.10, 2.36.8, 2.37.5, and 2.38.1 AI Gateway Path Traversal

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed?

What access does an attacker need?

What could an attacker access through this issue?

Which releases contain fixes?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

What access does an attacker need?

What could an attacker access through this issue?

Which releases contain fixes?