Executive Summary
A vulnerability in Coder, a popular open-source platform for building development environments, has been discovered. The vulnerability, tracked as CVE-2026-111927, is caused by an improper hostname validation flaw in the `GetWorkspaceProxyByHostname` function. This flaw allows attackers to lure authenticated victims to a crafted `/api/v2/applications/auth-redirect` link, capture the redirected `application_connect` API key, and replay it to access the victim's workspace applications.
Technical Analysis
The vulnerability is caused by a prefix match in the `GetWorkspaceProxyByHostname` function's `SIMILAR TO` pattern. This allows any domain that is a string prefix of a workspace-proxy access URL to be trusted as a proxy. An attacker owning such a domain can exploit this vulnerability.
How It Gets Exploited
An attacker would need to own a domain that is a string prefix of a workspace-proxy access URL. They would then lure an authenticated victim to a crafted `/api/v2/applications/auth-redirect` link. When the victim clicks the link, the attacker would capture the redirected `application_connect` API key. The attacker could then replay this API key to access the victim's workspace applications.
Impact Assessment
The vulnerability affects Coder versions before 2.29.20, 2.33.12, 2.34.8, and 2.35.4. The CVSS score for this vulnerability is 7.7, indicating a high severity level. An attacker exploiting this vulnerability could gain unauthorized access to workspace applications, potentially leading to confidentiality and integrity impacts.
Recommended Actions
To mitigate this vulnerability, administrators should update Coder to version 2.29.20 or later, 2.33.12 or later, 2.34.8 or later, or 2.35.4 or later. Additionally, administrators should monitor for suspicious activity, such as unusual API requests or access to workspace applications.
Sources
- National Vulnerability Database (NVD)
- CVE-2026-111927