CVE-2026-111929 coder CVE debrief

Who should care

Defenders responsible for IaC management, infrastructure security, and Coder deployments should assess the potential impact of this vulnerability on their organizations. This includes verifying Coder versions, restricting access to provisioner daemons, and monitoring for suspicious activity. Additionally, operators, platform administrators, and security teams should be aware of the potential risks and take necessary precautions to protect their systems.

Why it matters

CVE-2026-111929 is an authorization bypass vulnerability in Coder that allows authenticated provisioner daemons to download other organizations' cached Terraform module archives, potentially exposing infrastructure topology or embedded secrets. Defenders should prioritize verifying Coder versions, restricting access to provisioner daemons, and monitoring for suspicious activity.

• Potential exposure of infrastructure topology
• Potential exposure of embedded secrets
• Need to verify Coder versions and restrict access to provisioner daemons
• Need to monitor for suspicious activity related to Coder

Technical summary

The vulnerability is caused by an authorization bypass in the provisioner daemon DownloadFile gRPC handler in Coder. This allows authenticated provisioner daemons to download other organizations' cached Terraform module archives, potentially exposing infrastructure topology or embedded secrets. The vulnerability affects Coder versions from 2.30.0 before 2.34.8. An attacker with an organization-scoped provisioner key and a known file UUID can exploit this vulnerability to download Terraform module archives from other organizations.

Defensive priority

Defenders should prioritize verifying the versions of Coder in use within their organizations and assessing the potential impact of this vulnerability on their infrastructure.

Recommended defensive actions

• Verify Coder versions in use within the organization
• Assess potential impact on infrastructure
• Restrict access to provisioner daemons and Terraform module archives
• Monitor for suspicious activity related to Coder
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details about the vulnerability, including its description, CVSS score, and affected versions. However, the corpus does not establish evidence of exploitation or specific victims.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.