CVE-2026-126308: Coder 2.38.0 before 2.38.2 Session Token Leak via Sub-Agent External Apps
The web dashboard in Coder 2.24.0 before 2.29.23, 2.30.0 before 2.34.14, 2.35.0 before 2.36.9, 2.37.0 before 2.37.6, and 2.38.0 before 2.38.2 replaces the $SESSIONTOKEN placeholder in external app URLs with a full-access API key without checking whether the app belongs to a sub-agent. Code running in a workspace can register a disguised sub-agent app with a custom protocol URL, so the owner's click sends their API key to an attacker-chosen destination.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
Affected version ranges are Coder 2.24.0 before 2.29.23, 2.30.0 before 2.34.14, 2.35.0 before 2.36.9, 2.37.0 before 2.37.6, and 2.38.0 before 2.38.2.
What does an attacker need to exploit this issue?
The attacker needs code execution in a workspace so it can register a disguised sub-agent external app using a custom-protocol URL. The workspace owner must then click the app link in the web dashboard.
What is exposed if exploitation succeeds?
The dashboard can substitute the $SESSION_TOKEN placeholder with the workspace owner's full-access API key and send that key to an attacker-controlled destination. The exposed key can affect confidentiality and integrity.