GHSA-qrwj-vh9x-gw5v CVE-2026-63443 GO-2026-5923

Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write

High Go

Severity: 8.3 / 10; High · CVSS 3.1
Exploit chance (EPSS): 0.76%; Chance of exploitation in the next 30 days. Higher than 55.37% of scored vulnerabilities.
Known exploited: No; Not in CISA's catalog
Weakness: CWE-863 Incorrect Authorization; CWE-918 Server-Side Request Forgery (SSRF)
Fix: 2.34.4; Upgrade github.com/coder/coder/v2 to this version or later

Description

Summary

agentConn.apiClient() used the default redirect behavior of http.Client while its custom transport dialed the host from the request URL as long as the port was the workspace agent HTTP API port (4). Agent tailnet IPs are deterministic from agent UUIDs, so a malicious workspace agent could return a redirect to another agent's tailnet IP and cause the control-plane client to send the follow-up workspace agent API request to the victim agent instead of the intended agent.

Redirects that preserve the method and body, such as HTTP 307 and 308, allow replay of write and process-start requests. HTTP 301, 302 and 303 redirects only convert POST requests to GET requests, so they are sufficient to demonstrate redirected reads but not write or command-execution primitives.

Impact

An authenticated user with a running workspace and control of a modified workspace agent can redirect workspace agent API requests made to their agent toward another online workspace agent reachable on the tailnet. If the attacker knows the victim agent UUID, they can derive the victim's tailnet IP and target the victim's file APIs to read or write files as the victim workspace user.

In affected versions that expose the workspace agent process API, the same primitive can be chained to command execution as the victim workspace user by writing a payload through the redirected file API and then redirecting a process-start request to execute it. This crosses workspace and tenant boundaries.

Patches

The fix disables automatic redirect following for workspace agent API clients and pins all workspace agent API dials to the intended agent's deterministic tailnet address. Requests whose URL host does not match the intended agent are rejected instead of being dialed.

The fix was backported to all supported release lines:

Release line	Patched version
2.34	v2.34.4
2.33	v2.33.10
2.32	v2.32.9
2.29 (ESR)	v2.29.19

Workarounds

None. Upgrading is required.

Resources

Fix: #26600

Affected versions

Go

Package	Vulnerable	Fixed in
github.com/coder/coder	`all versions`	No fix yet
github.com/coder/coder/v2	`>= 2.34.0, < 2.34.4`	`2.34.4`
github.com/coder/coder/v2	`>= 2.33.0, < 2.33.10`	`2.33.10`
github.com/coder/coder/v2	`>= 2.30.0, < 2.32.9`	`2.32.9`
github.com/coder/coder/v2	`>= 2.27.0, < 2.29.19`	`2.29.19`
github.com/coder/coder/v2	`>= 2.27.0, < 2.29.19` `>= 2.30.0, < 2.32.9` `>= 2.33.0, < 2.33.10` `>= 2.34.0, < 2.34.4`	`2.29.19` `2.32.9` `2.33.10` `2.34.4`

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

github.com/coder/coder/v2 Go → `2.34.4`

go

go get github.com/coder/coder/v2@v2.34.4 && go mod tidy

Severity breakdown

CVSS 3.1 8.3

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

Attack vector: Network
Attack complexity: Low
Privileges required: Low
User interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: Low

Weakness

CWE-863: Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

How to prevent it

Architecture and Design: Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
Architecture and Design: Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
Architecture and Design: Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
Architecture and Design: For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page. One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
System Configuration, Installation: Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.

CWE-918: Server-Side Request Forgery (SSRF)

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

References

Packages

github.com/coder/coder

Timeline

Jul 6, 2026 Published
Sep 30, 2026 Last updated by the source
Oct 31, 2026 Latest EPSS score

Advisory	Severity	Why it's related
GHSA-h58c-xccx-75m3 Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings	Medium	Also affects github.com/coder/coder
GHSA-8fxq-53rx-ph5f Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison	Medium	Also affects github.com/coder/coder
GHSA-5wg6-jmq2-53pw Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing	Medium	Also affects github.com/coder/coder
GHSA-7qw2-f75v-62f7 Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component	Medium	Also affects github.com/coder/coder
GHSA-84rm-42xw-mx52 Coder's AI Bridge Proxy skips TLS certificate verification in default configuration	High	Also affects github.com/coder/coder
GHSA-wqxv-w64v-5wh6 Suspended Coder users retain access to AI Bridge LLM proxy endpoints	Medium	Also affects github.com/coder/coder
GHSA-f5vp-w269-392g Coder vulnerable to denial of service via unbounded request body in AI Bridge provider endpoints	Medium	Also affects github.com/coder/coder
GHSA-jqj2-x4c5-jfxm Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers	Medium	Also affects github.com/coder/coder

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor