CVE-2026-111927 coder CVE debrief

Who should care

Defenders responsible for Coder deployments, especially those using versions before 2.29.20, 2.33.12, 2.34.8, and 2.35.4, should assess their exposure and prioritize patching or mitigation.

Why it matters

CVE-2026-111927 is a high-severity vulnerability in Coder that allows for credential theft and potential workspace app access compromise. Defenders should prioritize patching or mitigating this vulnerability, especially in environments where Coder is used for development.

• Credential theft via API key replay is possible.
• Authenticated victims may be lured to crafted links.
• Workspace app access may be compromised.

Technical summary

The vulnerability is caused by the improper hostname validation in the GetWorkspaceProxyByHostname function. This allows an attacker to impersonate a workspace proxy by owning a domain that is a string prefix of a workspace-proxy access URL. The attacker can then lure an authenticated victim to a crafted /api/v2/applications/auth-redirect link, capture the redirected application_connect API key, and replay it to access the victim's workspace apps.

Defensive priority

Defenders should prioritize patching or mitigating this vulnerability, especially in environments where Coder is used for development.

Recommended defensive actions

• Patch Coder to version 2.29.20 or later, 2.33.12 or later, 2.34.8 or later, or 2.35.4 or later.
• Implement additional authentication and authorization checks for workspace proxy access.
• Monitor for suspicious activity related to application_connect API key usage.
• Conduct an inventory of Coder deployments to identify potentially exposed assets.
• Perform thorough reviews of workspace proxy access logs for signs of exploitation.
• Establish a change management process to ensure timely application of security updates.
• Track and verify the remediation status of affected systems.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its high CVSS score of 8.7. However, the record of affected versions and exploitation details are limited. Defenders should verify Coder version deployments, review official advisories for scope and severity, and assess exposure in their environments. Limited source details necessitate cautious validation of impacted assets and vigilance for potential API key misuse.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.