Path Traversal in Coder AI Gateway

Executive Summary

CVE-2026-121967 is a path traversal vulnerability in Coder's AI Gateway passthrough router. The issue occurs because the gateway forwards percent-encoded dot segments (like %2e%2e or ..%2F) to upstream services without validating them. The HTTP server only removes literal dot segments (..), so encoded paths bypass restrictions, allowing access to unintended provider endpoints using the deployment's centrally managed provider key.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor HTTP requests to the AI Gateway for encoded path traversal attempts like %2e%2e, ..%2F, or double-encoded sequences. Check logs for 400 errors from the gateway, which may indicate rejected traversal attempts. Use tools like curl to test paths: curl -v 'http://<coder-server>/ai-gateway/%2e%2e/admin' or curl -v 'http://<coder-server>/ai-gateway/..%2F..%2Fconfig'.

Useful 0 Not Useful 0

Impact Analysis

Authenticated users could exploit this to access restricted provider endpoints, potentially reading or modifying data beyond their intended scope. The impact includes unauthorized access to sensitive resources using the provider key, though the CVSS score suggests limited severity (2.3 v4.0, 4.9 v3.1).

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade Coder to a patched version (2.29.22, 2.34.13, 2.35.10, 2.36.8, 2.37.5, or 2.38.1+). If upgrading isn't possible, disable the AI Gateway feature or deploy a reverse proxy/WAF to block encoded path traversal patterns like %2e%2e, ..%2F, or double-encoded sequences.

Useful 0 Not Useful 0