Coder
Monthly
Authenticated Coder users who control a modified workspace agent can redirect the control plane's workspace-agent API requests to another online agent, reading or writing files as the victim workspace user and - on versions that expose the agent process API - executing commands as that user, crossing workspace and tenant boundaries. Exploitation requires knowing the victim agent's UUID, since agent tailnet IPs are deterministic from UUIDs, and requires redirects that preserve method and body (HTTP 307/308) to replay write and process-start requests; 301/302/303 only enable redirected reads. The issue is fixed in 2.29.19, 2.32.9, 2.33.10, and 2.34.4, with no vendor workaround, while EPSS is low (0.42%, ~36th percentile), SSVC exploitation is "none", and no public exploit code has been identified at time of analysis.
Coder allows organizations to provision remote development environments via Terraform. Prior to 2.26.5, 2.27.7, and 2.28.4, Workspace Agent manifests containing sensitive values were logged in plaintext unsanitized. An attacker with limited local access to the Coder Workspace (VM, K8s Pod etc.) or a third-party system (SIEM, logging stack) could access those logs. This vulnerability is fixed in 2.26.5, 2.27.7, and 2.28.4.
AgentAPI is an HTTP API for Claude Code, Goose, Aider, Gemini, Amp, and Codex. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Coder allows organizations to provision remote development environments via Terraform. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Coder allows oragnizations to provision remote development environments via Terraform. Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Versions of the package code-server before 4.10.1 are vulnerable to Missing Origin Validation in WebSockets handshakes. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
code-server is vulnerable to Inefficient Regular Expression Complexity. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Authenticated Coder users who control a modified workspace agent can redirect the control plane's workspace-agent API requests to another online agent, reading or writing files as the victim workspace user and - on versions that expose the agent process API - executing commands as that user, crossing workspace and tenant boundaries. Exploitation requires knowing the victim agent's UUID, since agent tailnet IPs are deterministic from UUIDs, and requires redirects that preserve method and body (HTTP 307/308) to replay write and process-start requests; 301/302/303 only enable redirected reads. The issue is fixed in 2.29.19, 2.32.9, 2.33.10, and 2.34.4, with no vendor workaround, while EPSS is low (0.42%, ~36th percentile), SSVC exploitation is "none", and no public exploit code has been identified at time of analysis.
Coder allows organizations to provision remote development environments via Terraform. Prior to 2.26.5, 2.27.7, and 2.28.4, Workspace Agent manifests containing sensitive values were logged in plaintext unsanitized. An attacker with limited local access to the Coder Workspace (VM, K8s Pod etc.) or a third-party system (SIEM, logging stack) could access those logs. This vulnerability is fixed in 2.26.5, 2.27.7, and 2.28.4.
AgentAPI is an HTTP API for Claude Code, Goose, Aider, Gemini, Amp, and Codex. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Coder allows organizations to provision remote development environments via Terraform. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Coder allows oragnizations to provision remote development environments via Terraform. Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Versions of the package code-server before 4.10.1 are vulnerable to Missing Origin Validation in WebSockets handshakes. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
code-server is vulnerable to Inefficient Regular Expression Complexity. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.