CVE-2026-111934 coder CVE debrief

Who should care

Defenders responsible for Coder installations, security teams monitoring for IP spoofing vulnerabilities, and administrators of applications using Coder for authentication or authorization should assess exposure and prioritize verification and mitigation.

Why it matters

CVE-2026-111934 is a medium-severity vulnerability in Coder before version 2.34.7 that allows IP spoofing, potentially leading to brute-force attacks and audit log falsification. Defenders should verify Coder versions, review middleware configurations, and ensure proper reverse proxy setup to mitigate this vulnerability.

• Potential for brute-force attacks on login, one-time passcode, and password validation endpoints due to bypassed rate limiting
• Falsification of IP addresses in audit logs, potentially hindering incident response and forensic analysis
• Need for verification of Coder version and configuration to ensure proper mitigation
• Importance of monitoring audit logs for potential IP spoofing attempts

Technical summary

The ExtractRealIPAddress middleware in Coder before 2.34.7 trusts the leftmost, client-supplied X-Forwarded-For value instead of the client IP provided by a reverse proxy. This allows attackers to send forged X-Forwarded-For values, potentially bypassing per-IP rate limits on login, one-time passcode, and password validation endpoints, and to falsify IP addresses recorded in audit logs. Affected product deployments should be verified, and defenders should review middleware configurations and ensure proper reverse proxy setup to mitigate IP spoofing.

Defensive priority

Defenders should prioritize verifying the use of Coder version 2.34.7 or later, reviewing configurations of the ExtractRealIPAddress middleware, and ensuring proper reverse proxy setup to mitigate IP spoofing.

Recommended defensive actions

• Verify Coder version and upgrade to 2.34.7 or later if necessary
• Review and adjust ExtractRealIPAddress middleware configurations
• Ensure proper reverse proxy setup to prevent IP spoofing
• Monitor audit logs for potential IP address falsifications
• Perform exposure review for Coder deployments
• Implement compensating controls for exposed systems
• Track exceptions and retest remediated assets

Evidence notes

The CVE record and NVD entry provide details on the IP spoofing vulnerability in Coder before 2.34.7. Additional information is available from source references, including a GitHub security advisory and a Vulncheck advisory.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.