CVE-2026-111931 coder CVE debrief

Who should care

Defenders responsible for Coder deployments, security teams, and developers should be aware of this vulnerability and take necessary actions to prevent potential phishing attacks. This includes verifying affected deployments, applying patches, and monitoring for potential phishing attacks targeting Coder users. Security teams should review and update security configurations to prevent exploitation.

Why it matters

CVE-2026-111931 is a medium-severity open redirect vulnerability in Coder that allows attackers to redirect users externally via unsanitized URL paths, potentially leading to phishing attacks. Defenders should prioritize verifying affected deployments, applying patches, and monitoring for potential phishing attacks.

• Phishing attacks may be launched against Coder users via crafted links on trusted workspace app subdomains.
• Defenders must verify affected Coder deployments and apply patches to prevent exploitation.
• Security teams should review and update security configurations to prevent exploitation.
• Monitoring for potential phishing attacks targeting Coder users is necessary.

Technical summary

The handleAPIKeySmuggling function in Coder contains an open redirect vulnerability, allowing attackers to redirect users externally via unsanitized r.URL.Path values. Attackers can craft links on trusted workspace app subdomains with paths beginning with double slashes, which become scheme-relative redirects to attacker sites for phishing. This vulnerability affects Coder versions from 2.0.0 before 2.34.8, with a CVSS score of 5.3 and a severity rating of MEDIUM. Defenders should prioritize verifying affected Coder deployments and applying the patch to prevent potential phishing attacks.

Defensive priority

Defenders should prioritize verifying affected Coder deployments and applying the patch to prevent potential phishing attacks.

Recommended defensive actions

• Verify if Coder deployments are affected by checking the version and applying the patch to prevent potential phishing attacks.
• Review and update security configurations to prevent exploitation.
• Monitor for potential phishing attacks targeting Coder users.
• Confirm whether affected Coder deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description and CVSS score. However, the corpus does not establish versions, exploitation, impact, or remediation beyond the provided information.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.