CVE-2026-126403: Coder 2.38.0 before 2.38.4 Authorization Bypass via External Agent Credentials Endpoint
Coder 2.26.0 before 2.29.24, 2.30.0 before 2.34.16, 2.35.0 before 2.36.11, 2.37.0 before 2.37.8, and 2.38.0 before 2.38.4 contains an improper authorization flaw in the external agent credentials endpoint, which returns the workspace agent token to users with only workspace read access rather than ssh permission. Authenticated users with roles such as Template Admin or Organization Admin can use the token to read the owner's private Git SSH key and Git provider OAuth tokens, and impersonate the agent to receive the owner's sessions.
Affected Software
Event History
Frequently Asked Questions
Which users can exploit this issue?
An attacker must be an authenticated user with workspace read access but without SSH permission. Roles such as Template Admin or Organization Admin are specifically identified as able to use the exposed agent token.
What can an attacker do with the returned workspace agent token?
The attacker can use it to read the workspace owner's private Git SSH key and Git provider OAuth tokens. They can also impersonate the workspace agent and receive the owner's sessions.
Which releases need to be updated?
Affected release ranges are 2.26.0 through before 2.29.24, 2.30.0 through before 2.34.16, 2.35.0 through before 2.36.11, 2.37.0 through before 2.37.8, and 2.38.0 through before 2.38.4.