Coder - vulnerabilities (CVEs)

42 CVEs in 4 products, 12 in the last 30 days, newest from 2026-10-28.

Products

• Coder - 35 CVEs
• Code-server - 3 CVEs
• Agentapi - 1 CVEs
• Code-marketplace - 1 CVEs

Newest CVEs of Coder

• CVE-2026-118687 - CVSS 8.3 (high), 2026-10-28: Coder before 2.29.21, 2.30.0 before 2.34.12, 2.35.0 before 2.35.9, 2.36.0 before 2.36.7, and 2.37.0 before 2.37.4 does not validate the audience claim of GCE…
• CVE-2026-111934 - CVSS 6.3 (medium), 2026-10-17: Coder before 2.34.7 contains an IP spoofing vulnerability in the ExtractRealIPAddress middleware that trusts the leftmost, client-supplied X-Forwarded-For…
• CVE-2026-111933 - CVSS 6.3 (medium), 2026-10-17: Coder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before 2.34.2 contains a user enumeration vulnerability because…
• CVE-2026-111931 - CVSS 5.3 (medium), 2026-10-17: Coder from 2.0.0 before 2.34.8 contains an open redirect vulnerability in handleAPIKeySmuggling that allows attackers to redirect users externally via…
• CVE-2026-111932 - CVSS 4.8 (medium), 2026-10-17: Coder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before 2.34.2 contains a stored HTML injection vulnerability because the…
• CVE-2026-111930 - CVSS 5.3 (medium), 2026-10-17: Coder from 2.26.0 before 2.34.8 contains an incorrect authorization flaw in the GET /api/v2/workspaces/{id}/acl endpoint, which checks only workspace read…
• CVE-2026-111928 - CVSS 5.4 (medium), 2026-10-17: Coder from 2.0.0 before 2.34.8 contains an incorrect authorization vulnerability in the acl_allow rule of coderd/rbac/policy.rego, which does not verify…
• CVE-2026-111929 - CVSS 6 (medium), 2026-10-17: Coder from 2.30.0 before 2.34.8 contains an authorization bypass vulnerability in the provisioner daemon DownloadFile gRPC handler that allows authenticated…
• CVE-2026-111927 - CVSS 8.7 (high), 2026-10-17: Coder before 2.29.20, 2.33.0 before 2.33.12, 2.34.0 before 2.34.8, and 2.35.0 before 2.35.4 contains an improper hostname validation flaw in…
• CVE-2026-111926 - CVSS 4.8 (medium), 2026-10-17: Coder from 2.10.0 before 2.34.8 has an unauthenticated agent debug HTTP server on 127.0.0.1:2113 whose /debug/manifest handler returns the full agent…
• CVE-2025-71435 - CVSS 4.2 (medium), 2026-10-17: Coder before 2.23.0 contains a session expiration bypass vulnerability that allows authenticated users to retain access after OIDC token expiry when no…
• CVE-2024-58398 - CVSS 5.3 (medium), 2026-10-17: Coder 2.3.1 before 2.14.4, 2.15.x before 2.15.3, and 2.16.0 before 2.16.1 contains an open redirect vulnerability in the login page because the redirect query…
• CVE-2026-63443 - CVSS 8.3 (high), 2026-09-15: Coder allows organizations to provision remote development environments via Terraform. Prior to 2.29.19, 2.32.9, 2.33.10, and 2.34.4, agentConn.apiClient()…
• CVE-2026-55438 - CVSS 6.8 (medium), 2026-07-08: Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.17, 2.32.7, 2.33.8, and 2.34.2, Coder's…
• CVE-2026-55437 - CVSS 5.4 (medium), 2026-07-08: Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.17, 2.32.7, 2.33.8, and 2.34.2, the…
• CVE-2026-55436 - CVSS 7.4 (high), 2026-07-08: Coder allows organizations to provision remote development environments via Terraform. Starting in version 2.30.0 and prior to versions 2.32.7, 2.33.8, and…
• CVE-2026-55433 - CVSS 5.4 (medium), 2026-07-08: Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, the devcontainer…
• CVE-2026-55432 - CVSS 5.4 (medium), 2026-07-08: Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, the…
• CVE-2026-55431 - CVSS 7.7 (high), 2026-07-08: Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, `coder open app`…
• CVE-2026-55430 - CVSS 6.8 (medium), 2026-07-08: Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, the workspace app…
• CVE-2026-55429 - CVSS 8.7 (high), 2026-07-08: Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2,…
• CVE-2026-55428 - CVSS 8.2 (high), 2026-07-07: Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, the tailnet…
• CVE-2026-55427 - CVSS 8.3 (high), 2026-07-07: Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, `coder…
• CVE-2026-55079 - CVSS 6.5 (medium), 2026-07-07: Coder allows organizations to provision remote development environments via Terraform. Starting in version 2.24.0 and prior to versions 2.29.7, 2.32.7,…
• CVE-2026-55078 - CVSS 6.5 (medium), 2026-07-07: Coder allows organizations to provision remote development environments via Terraform. Starting in version 2.17.0 and prior to versions 2.29.7, 2.32.7,…
• CVE-2026-55077 - CVSS 7.2 (high), 2026-07-07: Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, the `PUT…
• CVE-2026-55076 - CVSS 7.4 (high), 2026-07-07: Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, Coder's OIDC…
• CVE-2026-55075 - CVSS 7.4 (high), 2026-07-07: Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, two flaws in…
• CVE-2026-46354 - CVSS 9.1 (critical), 2026-07-07: Coder allows organizations to provision remote development environments via Terraform. In versions prior tp 2.24.5, 2.29.13, 2.30.8, 2.31.12, 2.32.2, and…
• CVE-2026-45796 - CVSS 6.5 (medium), 2026-07-07: Coder allows organizations to provision remote development environments via Terraform. Versions prior tp 2.24.5, 2.29.13, 2.30.8, 2.31.12, 2.32.2, and 2.33.3…