CVE-2026-111926 coder CVE debrief

Who should care

Defenders responsible for Coder installations, especially those with lower-privileged users or processes in the same workspace, should assess exposure and take immediate action to restrict access to the debug endpoint or update to a fixed version.

Why it matters

CVE-2026-111926 is a medium-severity vulnerability in Coder that allows lower-privileged users or processes to access sensitive credentials through an unauthenticated debug endpoint. Defenders should verify exposure, restrict access, and prioritize updates to mitigate potential credential exposure and unauthorized access.

• Credential exposure to lower-privileged users or processes
• Potential unauthorized access to sensitive information
• Need for verification of Coder installations and user access controls
• Priority for updating to a fixed version of Coder

Technical summary

The Coder tool, used for development environments, has an unauthenticated agent debug HTTP server listening on localhost at port 2113. The /debug/manifest handler of this server exposes sensitive information, including environment variable values provided by templates, which can contain credentials like cloud keys or registry tokens. A lower-privileged Unix user or process within the same workspace can query this endpoint to access these credentials.

Defensive priority

Defenders should prioritize verifying if their Coder installations are exposed to this vulnerability, especially if lower-privileged users or processes have access to the same workspace. Immediate action is required to restrict access to the debug endpoint or update to a fixed version.

Recommended defensive actions

• Verify Coder installations for exposure, especially if lower-privileged users or processes have access to the same workspace.
• Restrict access to the debug endpoint.
• Update to a fixed version of Coder.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD entry provide details about the vulnerability. However, the corpus does not establish versions, exploitation, impact, or remediation beyond vendor-provided information. Defenders should verify if their Coder installations are exposed, especially if lower-privileged users or processes have access to the same workspace. The debug endpoint's exposure can lead to credential access. Verification of Coder installations, user access controls, and updates to a fixed version are recommended. Evidence from the CVE and NVD

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.