High priorityDisclosed

Advisory · CVE-2026-111927

Coder workspace proxy hostname prefix match can leak a workspace API key

Coder before 2.29.20, 2.33.0 before 2.33.12, 2.34.0 before 2.34.8, and 2.35.0 before 2.35.4 trusts any domain that is a string prefix of a workspace-proxy access URL, so an attacker can capture a redirected application_connect API key and replay it against the victim workspace. CVSS 4.0 8.7 (CVSS 3.1 7.7).

Advisory published October 17, 2026Independent summary
Vendor
Coder
Product
Coder
Identifier / CWE
CVE-2026-111927
CWE-522
Action timing
Immediate
ELI5

Explain it like I’m five

Coder checks a proxy address by its first letters instead of the whole name, so a lookalike domain that starts the same way is trusted with a live workspace key.

SIMPLIFIED_ATTACK_PATH03 STEPS
  1. 01Lookalike domain owned

    An attacker controls a domain that is a string prefix of a workspace-proxy access URL.

  2. 02Victim lured to redirect

    The attacker lures an authenticated victim to a crafted auth-redirect link for a workspace app.

  3. 03Key captured and replayed

    The redirect hands the application_connect API key to the attacker domain, and the attacker replays it to access the victim workspace apps.

What happened

Coder disclosed CVE-2026-111927: an improper hostname validation flaw in GetWorkspaceProxyByHostname, whose SIMILAR TO pattern performs a prefix match, so any domain that is a string prefix of a workspace-proxy access URL is trusted as a proxy. Attackers owning such a domain can capture a redirected application_connect API key and replay it to access the victim workspace apps.

Per the vendor affected data in the NVD record, the first unaffected releases are 2.29.20, 2.33.12, 2.34.8, and 2.35.4 for their respective lines.

What to do

  1. Inventory Coder deployments and note which release line each one runs.
  2. Upgrade affected deployments to 2.29.20, 2.33.12, 2.34.8, or 2.35.4 or later, matching the line in use.
  3. Review workspace app access and proxy logs for auth-redirect requests involving unfamiliar lookalike domains.
  4. Rotate application_connect keys and workspace credentials for users who followed suspicious redirect links.
  5. Verify the deployed version after updating, not just that an update ran.

Management note

Developer workspaces hold source code and cloud credentials, so a stolen workspace key is rarely contained to one app. Upgrade, then treat any key sent to a lookalike domain as compromised.