CVE-2026-111927
Full vulnerability record from the local CVENow database.
Description
Coder before 2.29.20, 2.33.0 before 2.33.12, 2.34.0 before 2.34.8, and 2.35.0 before 2.35.4 contains an improper hostname validation flaw in GetWorkspaceProxyByHostname whose SIMILAR TO pattern performs a prefix match, so any domain that is a string prefix of a workspace-proxy access URL is trusted as a proxy. Attackers owning such a domain can lure an authenticated victim to a crafted /api/v2/applications/auth-redirect link, capture the redirected application_connect API key, and replay it to access the victim's workspace apps.
Severity
HIGH
CVSS score
8.7
(v4.0)
Vulnerability status
Awaiting Analysis
Source identifier
Published
2026-10-17 19:16:35.527000
Last modified
2026-11-04 23:10:00.223000
View original CVE JSON
{
"id": "CVE-2026-111927",
"sourceIdentifier": "[email protected]",
"published": "2026-10-17T19:16:35.527",
"lastModified": "2026-11-04T23:10:00.223",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Coder before 2.29.20, 2.33.0 before 2.33.12, 2.34.0 before 2.34.8, and 2.35.0 before 2.35.4 contains an improper hostname validation flaw in GetWorkspaceProxyByHostname whose SIMILAR TO pattern performs a prefix match, so any domain that is a string prefix of a workspace-proxy access URL is trusted as a proxy. Attackers owning such a domain can lure an authenticated victim to a crafted /api/v2/applications/auth-redirect link, capture the redirected application_connect API key, and replay it to access the victim's workspace apps."
},
{
"lang": "es",
"value": "Coder en versiones anteriores a la 2.29.20, y en las ramas 2.33.0, 2.34.0 y 2.35.0 en versiones anteriores a la 2.33.12, 2.34.8 y 2.35.4 respectivamente, contiene un fallo de validación de nombre de host inadecuada en GetWorkspaceProxyByHostname, cuyo patrón SIMILAR TO realiza una coincidencia de prefijo, por lo que cualquier dominio que sea un prefijo de cadena de una URL de acceso de proxy de espacio de trabajo es de confianza como proxy. Los atacantes que poseen dicho dominio pueden atraer a una víctima autenticada a un enlace /API/v2/applications/auth-redirect manipulado, capturar la clave API application_connect redirigida y reproducirla para acceder a las aplicaciones del espacio de trabajo de la víctima."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "coder",
"product": "coder",
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/coder/coder/v2",
"versions": [
{
"version": "2.35.0",
"lessThan": "2.35.4",
"versionType": "semver",
"status": "affected"
},
{
"version": "2.35.4",
"versionType": "semver",
"status": "unaffected"
}
]
},
{
"vendor": "coder",
"product": "coder",
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/coder/coder/v2",
"versions": [
{
"version": "2.34.0",
"lessThan": "2.34.8",
"versionType": "semver",
"status": "affected"
},
{
"version": "2.34.8",
"versionType": "semver",
"status": "unaffected"
}
]
},
{
"vendor": "coder",
"product": "coder",
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/coder/coder/v2",
"versions": [
{
"version": "2.33.0",
"lessThan": "2.33.12",
"versionType": "semver",
"status": "affected"
},
{
"version": "2.33.12",
"versionType": "semver",
"status": "unaffected"
}
]
},
{
"vendor": "coder",
"product": "coder",
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/coder/coder/v2",
"versions": [
{
"version": "0",
"lessThan": "2.29.20",
"versionType": "semver",
"status": "affected"
},
{
"version": "2.29.20",
"versionType": "semver",
"status": "unaffected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"privilegesRequired": "LOW",
"userInteraction": "PASSIVE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "LOW",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 1.3,
"impactScore": 5.8
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-10-21T21:45:28.936667Z",
"id": "CVE-2026-111927",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-522"
}
]
}
],
"references": [
{
"url": "https://github.com/coder/coder/security/advisories/GHSA-h58h-qvv5-xvwg",
"source": "[email protected]"
},
{
"url": "https://www.vulncheck.com/advisories/coder-before-2.35.4-credential-theft-via-workspace-proxy-hostname-prefix-match",
"source": "[email protected]"
}
]
}