CVE-2026-126404: Coder from 2.38.0 before 2.38.4 Privilege Escalation via API Key Creation
Coder 2.28.0 before 2.29.24, 2.30.0 before 2.34.16, 2.35.0 before 2.36.11, 2.37.0 before 2.37.8, and 2.38.0 before 2.38.4 does not restrict new API keys to the creating token's scopes, allow list, or expiry. A scoped API key or OAuth2 token holding key-creation permission can call POST /api/v2/users/{user}/keys/tokens to mint longer-lived coder:all keys, gaining the user's full privileges.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.29.24 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.34.16 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.36.11 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.37.8 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.38.4
Event History
Frequently Asked Questions
Which deployments and versions are affected?
Affected releases are Coder 2.28.0 before 2.29.24, 2.30.0 before 2.34.16, 2.35.0 before 2.36.11, 2.37.0 before 2.37.8, and 2.38.0 before 2.38.4.
What access does an attacker need to escalate privileges?
An attacker needs a scoped API key or OAuth2 token that has permission to create API keys. They can use that credential to call POST /api/v2/users/{user}/keys/tokens and create a longer-lived coder:all key.
What is the resulting impact of successful exploitation?
The newly created coder:all key grants the attacker the full privileges of the user associated with the original credential. The vulnerability can therefore turn a restricted or scoped credential into a broadly privileged, longer-lived one.
How can defenders look for possible exploitation?
Review requests to POST /api/v2/users/{user}/keys/tokens made with scoped API keys or OAuth2 tokens that have key-creation permission. Investigate keys created through that endpoint that have coder:all scope, a broader allow list than the creating credential, or an unexpectedly long expiry.