Coder CVE-2026-111926

Requires a lower-privileged local Unix user or unprivileged process running inside the same Coder workspace as the agent; the agent debug HTTP server must be present and bound to 127.0.0.1:2113 (default in affected 2.10.0-2.34.7 builds), and the workspace template must actually define environment variables containing secrets for there to be anything worth stealing. Limiting factors: the endpoint is loopback-only and therefore NOT remotely reachable, so no network exposure exists; impact is bounded to whatever secrets are present in the template-provided env vars; single-user workspaces with no untrusted co-tenant processes face little practical risk. Fixed in 2.34.8.

This is a genuine but moderate, locally-scoped information-disclosure issue rather than a mass-exploitation priority. The official CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N) correctly models the real constraint: despite the description calling the debug server 'unauthenticated,' exploitation is NOT remote - the server binds to loopback (127.0.0.1:2113), so an attacker must already be a lower-privileged Unix user or process co-located inside the same Coder workspace (hence PR:L, AV:L). The 'unauthenticated' wording refers only to the HTTP endpoint lacking its own auth check, not to network-level unauthenticated access; this nuance should be kept clear to avoid overrating it as a remote flaw. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation - consistent with a bug requiring prior local foothold. The one factor that elevates impact above the base score's 4.8 is the TYPE of data exposed: cloud keys and registry tokens are high-value secrets enabling lateral movement/privilege escalation, which is why my independent assessment rates confidentiality higher (C:H) than the vendor's VC:L. Net: patch it as part of normal maintenance and prioritize on hosts where untrusted or multi-tenant users share workspaces, but it is not a drop-everything remote RCE.

In a shared Coder workspace, a low-privileged local user or a compromised unprivileged process issues an HTTP GET to http://127.0.0.1:2113/debug/manifest and receives the full agent manifest, including template-provided environment variables. The attacker harvests embedded cloud provider keys and container-registry tokens and uses them to access cloud resources or pull/push private images. No public exploit code is identified, but the attack is trivial to script given only shell access inside the workspace.