CO
Product
coder
36
CVEs
0
On KEV
9.1
Max CVSS
12
New 30D
Severity mix
Critical 1High 12Medium 19Low 4
Watch
Add coder to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-55438 | 6.8 | Jul 8 | Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing Affected: >= 2.34.0, < 2.34.2; >= 2.33.0, < 2.33.8; >= 2.30.0, < 2.32.7; < 2.29.17 |
| CVE-2026-55430 | 6.8 | Jul 8 | Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access Affected: >= 2.34.0, < 2.34.2; >= 2.33.0, < 2.33.8; >= 2.30.0, < 2.32.7; < 2.29.17 |
| CVE-2026-118687 New | 6.5 | Oct 28 | Coder before 2.29.21, 2.34.12, 2.35.9, 2.36.7, and 2.37.4 Missing Audience Validation in GCP Instance-Identity Authentication Affected: 2.37.0 before 2.37.4; 2.36.0 before 2.36.7; 2.35.0 before 2.35.9; 2.30.0 before 2.34.12; before 2.29.21 |
| CVE-2026-55079 | 6.5 | Jul 7 | Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service Affected: >= 2.34.0, < 2.34.2; >= 2.33.0, < 2.33.8; >= 2.30.0, < 2.32.7; >= 2.24.0, < 2.29.17 |
| CVE-2026-55078 | 6.5 | Jul 7 | Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service Affected: >= 2.34.0, < 2.34.2; >= 2.33.0, < 2.33.8; >= 2.30.0, < 2.32.7; >= 2.17.0, < 2.29.17 |
| CVE-2026-45796 | 6.5 | Jul 7 | Coder vulnerable to unauthenticated SSRF via Azure Instance Identity Endpoint Affected: >= 2.33.0-rc.0, < 2.33.3; >= 2.32.0-rc.0, < 2.32.2; >= 2.31.0, < 2.31.12; >= 2.30.0, < 2.30.8; >= 2.29.0, < 2.29.13; < 2.24.5 |
| CVE-2026-55434 | 6.5 | Jul 7 | Coder vulnerable to denial of service via unbounded request body in AI Bridge provider endpoints Affected: >= 2.34.0, < 2.34.2; >= 2.33.0, < 2.33.8 |
| CVE-2026-55431 | 6.1 | Jul 8 | Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps Affected: >= 2.34.0, < 2.34.2; >= 2.33.0, < 2.33.8; >= 2.30.0, < 2.32.7; < 2.29.17 |
| CVE-2025-66411 | 5.5 | Dec 3 | Coder logged sensitive objects unsanitized Affected: >= 2.28.0, < 2.28.4; >= 2.27.0, < 2.27.7; < 2.26.5 |
| CVE-2026-111928 | 5.4 | Oct 17 | Coder 2.0.0 before 2.34.8 Authorization Bypass via User-Level ACL in RBAC Policy Affected: 2.0.0 before 2.34.8 |
| CVE-2026-55437 | 5.4 | Jul 8 | Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component Affected: >= 2.34.0, < 2.34.2; >= 2.33.0, < 2.33.8; >= 2.30.0, < 2.32.7; < 2.29.17 |
| CVE-2026-55433 | 5.4 | Jul 8 | Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers Affected: >= 2.34.0, < 2.34.2; >= 2.33.0, < 2.33.8; >= 2.30.0, < 2.32.7; < 2.29.17 |
| CVE-2026-55432 | 5.4 | Jul 8 | Coder's sub-agent app registration bypasses template port-sharing policy enforcement Affected: >= 2.34.0, < 2.34.2; >= 2.33.0, < 2.33.8; >= 2.30.0, < 2.32.7; < 2.29.17 |
| CVE-2026-55435 | 5.4 | Jul 7 | Suspended Coder users retain access to AI Bridge LLM proxy endpoints Affected: >= 2.34.0, < 2.34.2; >= 2.33.0, < 2.33.8; >= 2.30.0, < 2.32.7 |
| CVE-2026-111929 | 5.3 | Oct 17 | Coder 2.30.0 before 2.34.8 Cross-Organization File Disclosure via DownloadFile RPC Affected: 2.30.0 before 2.34.8 |
| CVE-2026-111931 | 4.3 | Oct 17 | Coder 2.0.0 before 2.34.8 Open Redirect via Workspace App Proxy Affected: 2.0.0 before 2.34.8 |
| CVE-2026-111930 | 4.3 | Oct 17 | Coder from 2.26.0 before 2.34.8 Information Disclosure via Workspace ACL Endpoint Affected: 2.26.0 before 2.34.8 |
| CVE-2024-58398 | 4.3 | Oct 17 | Coder 2.3.1 before 2.16.1 Open Redirect via Login Page redirect Parameter Affected: 2.16.0 before 2.16.1; 2.15.0 before 2.15.3; 2.3.1 before 2.14.4 |
| CVE-2025-71435 | 4.2 | Oct 17 | Coder before 2.23.0 Session Expiration Bypass via OIDC Without Refresh Token Affected: before 2.23.0 |
Showing 19