CVE-2026-126404
Received Received - Intake

Remote Code Execution in Coder Platform via API Key Privilege Escalation

Publication date: 2026-11-13

Last updated on: 2026-11-13

Assigner: VulnCheck

Description
Coder 2.28.0 before 2.29.24, 2.30.0 before 2.34.16, 2.35.0 before 2.36.11, 2.37.0 before 2.37.8, and 2.38.0 before 2.38.4 does not restrict new API keys to the creating token's scopes, allow list, or expiry. A scoped API key or OAuth2 token holding key-creation permission can call POST /api/v2/users/{user}/keys/tokens to mint longer-lived coder:all keys, gaining the user's full privileges.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-13
Last Modified
2026-11-13
Generated
2026-11-13
AI Q&A
2026-11-13
EPSS Evaluated
N/A
NVD
CVE-2026-126404
EUVD
EUVD-2026-125161

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
coder coder to 2.29.24 (exc)
coder coder to 2.34.16 (exc)
coder coder to 2.36.11 (exc)
coder coder to 2.37.8 (exc)
coder coder to 2.38.4 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-266 A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-126404 is a privilege escalation flaw in Coder versions 2.28.0 to 2.38.3. It allows a user with a scoped API key or OAuth2 token that has key-creation permissions to create new API keys with broader permissions than the original token. Specifically, the new keys can have unrestricted access (coder:all) even if the original token was limited. This happens because Coder does not enforce scope, allow list, or expiry restrictions when generating new keys via the POST /api/v2/users/{user}/keys/tokens endpoint.

Detection Guidance

Check Coder versions for affected releases (2.28.0 to 2.38.3). Review API key creation logs for POST /api/v2/users/{user}/keys/tokens requests. Look for keys with coder:all scope created by limited tokens. Use Coder admin dashboard to audit API keys and their permissions.

Impact Analysis

If you use Coder with a scoped API key or OAuth2 token that has key-creation permissions, an attacker with access to that token could escalate their privileges. They could create a new API key with full access (coder:all), gaining your full user privileges. This could lead to unauthorized access to sensitive data, modification of system configurations, or further exploitation within your Coder environment.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, which may violate GDPR's data protection principles or HIPAA's safeguards for protected health information. If exploited, it could result in data breaches, unauthorized modifications, or loss of audit trails, potentially leading to non-compliance with these regulations.

Mitigation Strategies

Upgrade Coder to patched versions (2.38.4+ or specific backported versions). Revoke all existing API keys and OAuth tokens. Do not grant key-creation scopes (e.g., coder:apikeys.manage_self) to scoped tokens. Treat restricted allow lists as full access until verified.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-126404. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...