Cross-Site Request Forgery in Coder Workspace Dashboard

Executive Summary

CVE-2026-126308 is a session token leak in Coder's web dashboard affecting versions 2.24.0 to 2.38.1. The dashboard replaces $SESSION_TOKEN in external app URLs with a full-access API key without verifying if the app belongs to a sub-agent. Attackers can register a malicious sub-agent app with a custom URL, causing the victim's API key to be sent to an attacker-controlled destination when clicked.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your Coder instance is running a vulnerable version (2.24.0 to 2.38.1). Review external app configurations in the web dashboard for suspicious URLs containing $SESSION_TOKEN. Inspect network traffic for unexpected API key transmissions to untrusted destinations.

Useful 0 Not Useful 0

Impact Analysis

If exploited, an attacker could obtain a full-access API key for the victim's workspace, allowing them to act as the user for the key's lifetime. This could lead to unauthorized access, data theft, or further compromise of the system. Exploitation requires running code as a sub-agent and the victim clicking a malicious app link.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. A successful exploit may result in data breaches, triggering mandatory breach notification and potential fines under these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade Coder to a patched version (2.38.2 or later, or specific earlier versions like 2.37.6, 2.36.9, 2.34.14, or 2.29.23). Avoid clicking external apps from untrusted sub-agents until upgraded. Review and remove any suspicious external apps registered in your workspace.

Useful 0 Not Useful 0