Coder: Credential theft via workspace proxy hostname prefix match
Summary
Coder contains a flaw in its workspace proxy hostname validation, where a prefix match lets an attacker-owned domain be trusted as a proxy. An attacker who owns such a domain and lures an authenticated user to a crafted /api/v2/applications/auth-redirect link can capture the victim's application_connect API key. The attacker can then replay this key to access the victim's workspace applications. The attack requires a valid Coder account, user interaction and a domain that is a string prefix of a real workspace proxy URL.
Affected
- Coder 2.35.0 to before 2.35.4
- Coder 2.34.0 to before 2.34.8
- Coder 2.33.0 to before 2.33.12
- Coder before 2.29.20
- Only deployments that use workspace proxies are affected, according to the vendor.
Fixed in
- Coder 2.35.4
- Coder 2.34.8
- Coder 2.33.12
- Coder 2.29.20
- Release lines 2.30 to 2.32 are end-of-life and will not receive a patch.
Workaround
No configuration-only workaround is documented by the vendor. Upgrade to a patched release.
Exploitation
- No known exploitation in the wild.
- No public proof of concept found.
- CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
Our recommendation
- Identify all Coder deployments and workspace proxies and check their versions.
- Upgrade to the patched release of your branch: 2.35.4, 2.34.8, 2.33.12 or 2.29.20.
- Until patched, review auth-redirect logs for unusual requests and unexpected proxy hostnames.
- Monitor the vendor advisory and NVD for updates.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-h58h-qvv5-xvwg github.com
- VulnCheck advisory www.vulncheck.com
- CVE record (CNA data) raw.githubusercontent.com
- Coder release v2.35.4 release notes newreleases.io
- Coder release v2.34.8 release notes newreleases.io
- VulDB CVE-2026-111927 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 02:06.
Original description (NVD)
Coder before 2.29.20, 2.33.0 before 2.33.12, 2.34.0 before 2.34.8, and 2.35.0 before 2.35.4 contains an improper hostname validation flaw in GetWorkspaceProxyByHostname whose SIMILAR TO pattern performs a prefix match, so any domain that is a string prefix of a workspace-proxy access URL is trusted as a proxy. Attackers owning such a domain can lure an authenticated victim to a crafted /api/v2/applications/auth-redirect link, capture the redirected application_connect API key, and replay it to access the victim's workspace apps.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.