CVE-2026-111927
7.7HighPublished 17 Oct 2026 · NVD status: Received · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- Low
- User interaction
- Required
- Impact
- High impact on confidentiality, integrity
- Weakness
- CWE-522
Impact
Attackers owning a domain prefix of a workspace-proxy URL can steal an authenticated user's application_connect API key and hijack their workspace applications. To execute this, the attacker needs a matching domain and must trick an authenticated user into clicking a crafted redirect link.
Root cause
The GetWorkspaceProxyByHostname function uses an improper SIMILAR TO pattern that matches domain prefixes instead of exact hostnames.
Affected systems
Coder versions before 2.29.20, 2.33.0 through 2.33.11, 2.34.0 through 2.34.7, and 2.35.0 through 2.35.3
CVSS v3.1 · CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N
Fix & remediation
Upgrade Coder to version 2.29.20, 2.33.12, 2.34.8, 2.35.4, or later. No workaround or interim mitigation is provided.
$ coder versionAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Coder before 2.29.20, 2.33.0 before 2.33.12, 2.34.0 before 2.34.8, and 2.35.0 before 2.35.4 contains an improper hostname validation flaw in GetWorkspaceProxyByHostname whose SIMILAR TO pattern performs a prefix match, so any domain that is a string prefix of a workspace-proxy access URL is trusted as a proxy. Attackers owning such a domain can lure an authenticated victim to a crafted /api/v2/applications/auth-redirect link, capture the redirected application_connect API key, and replay it to access the victim's workspace apps.