EUVD-2026-42071
GHSA-wqxv-w64v-5wh6
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Valid API key required (PR:L, AV:N); impact limited to LLM proxy access and MCP tool invocation with no availability or scope-change effect.
Primary rating from Vendor (https://github.com/coder/coder).
CVSS VectorVendor: https://github.com/coder/coder
Lifecycle Timeline
1DescriptionCVE.org
Summary
AI Bridge proxy endpoints authenticate via Server.IsAuthorized in coderd/aibridgedserver, which validates key format, expiry, secret and deleted or system users but does not check whether the account is suspended. Because suspension does not revoke existing API keys, a suspended user's unexpired token keeps working.
> Note: Practical impact is limited to already-issued API keys of suspended users until those keys are deleted.
Impact
A suspended user with a previously issued long-lived token could continue calling AI Bridge LLM proxy endpoints, consuming paid provider resources billed to the deployment and, if injected MCP tools are enabled, invoking those tools. Access persists until the token expires, which may be months after suspension.
Patches
The fix makes AI Bridge authorization reject non-active users like the standard API key middleware. AI Bridge was introduced in v2.30.0. The v2.29 ESR line is not affected.
The fix is available in the following releases:
Workarounds
On suspension, delete the user's API keys via DELETE /api/v2/users/{user}/keys.
Resources
- Fix: #26173
Credits
Coder would like to thank Anthropic's Security Team (ANT-2026-22446) for independently disclosing this issue!
AnalysisAI
Incorrect authorization in Coder's AI Bridge proxy (introduced in v2.30.0) permits suspended users to continue accessing LLM proxy endpoints using previously issued, unexpired API keys. The Server.IsAuthorized function in coderd/aibridgeserver validates key format, expiry, secret, and deleted/system-user status but omits the active/suspended status check present in the standard API key middleware, creating a divergence that survives indefinitely until tokens expire or are manually deleted. No public exploit code exists and the flaw is not listed in CISA KEV; the vendor patched all active release lines following coordinated disclosure by Anthropic's Security Team (ANT-2026-22446).
Technical ContextAI
Coder (Go module pkg:go/github.com_coder_coder_v2) is a self-hosted developer workspace platform. AI Bridge, introduced in v2.30.0, acts as a reverse proxy to external LLM providers and optionally exposes Model Context Protocol (MCP) tool integrations. The authorization function Server.IsAuthorized in coderd/aibridgeserver performs partial key validation - checking format, expiry timestamp, cryptographic secret, and whether the user is deleted or a system account - but does not evaluate the user's active status flag. This is a textbook CWE-863 (Incorrect Authorization) defect: the authorization logic exists but is incomplete, granting access that the broader access-control model intends to deny. Because API key records are not automatically revoked when a user is suspended, the incomplete check creates a persistent gap independent of the suspension event itself.
RemediationAI
Upgrade to v2.34.2, v2.33.8, or v2.32.7 depending on the active release line; these versions align AI Bridge authorization with the standard API key middleware by rejecting non-active users. Patched releases are tagged at https://github.com/coder/coder/releases/tag/v2.34.2, v2.33.8, and v2.32.7 respectively, with the fix PR at https://github.com/coder/coder/pull/26164. For deployments that cannot patch immediately, the vendor-recommended workaround is to explicitly delete all API keys for each suspended user via the API endpoint DELETE /api/v2/users/{user}/keys. This workaround is effective but requires manual or scripted execution per suspension event and must be applied retroactively to all currently suspended users - it does not self-heal and introduces an operational dependency on the offboarding process. No patch side effects are noted by the vendor.
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today