CVE-2026-63443
Received Received - Intake

Redirect-Based SSRF in Coder Remote Development Environments

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: GitHub, Inc.

Description
Coder allows organizations to provision remote development environments via Terraform. Prior to 2.29.19, 2.32.9, 2.33.10, and 2.34.4, agentConn.apiClient() follows redirects while its custom transport accepts the host from the redirected request URL when the port is the workspace agent HTTP API port 4. An authenticated user who controls a modified workspace agent and knows another online agent's UUID can derive the victim's tailnet address and redirect control-plane requests to that agent. HTTP 301, 302, and 303 redirects can redirect read requests, while HTTP 307 and 308 preserve replayable write and process-start requests. The redirected workspace agent file APIs can read or write files as the victim workspace user, and affected versions exposing the workspace agent process API can execute commands after a redirected file write, crossing workspace and tenant boundaries. This issue is fixed in versions 2.29.19, 2.32.9, 2.33.10, and 2.34.4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-63443
EUVD
EUVD-2026-78927

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
coder coder 2.29.19
coder coder 2.32.9
coder coder 2.33.10
coder coder 2.34.4
coder coder From 2.27.0 (inc) to 2.34.4 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-63443 is a vulnerability in Coder's workspace agent API client where HTTP redirects were followed without validation. This allowed a malicious workspace agent to redirect requests to another agent's unauthenticated port-4 API on the shared tailnet. The attacker could exploit this to perform cross-tenant file read/write operations or remote code execution (RCE) by targeting a victim agent's deterministic tailnet IP derived from its UUID.

Detection Guidance

Detecting this vulnerability requires checking if your Coder deployment is running a vulnerable version. Use commands like 'coder version' to check the installed version. If it is below 2.29.19, 2.32.9, 2.33.10, or 2.34.4, the system is vulnerable. Additionally, monitor network traffic for unexpected HTTP redirects between agents on port 4.

Impact Analysis

If you use an unpatched version of Coder (between 2.27.0 and 2.34.3), an attacker with control over a modified workspace agent could access your files, modify them, or execute commands as your user account. This crosses workspace and tenant boundaries, potentially leading to data theft, unauthorized changes, or system compromise.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. Organizations using unpatched Coder versions risk non-compliance due to potential data breaches, unauthorized modifications, or exposure of regulated data.

Mitigation Strategies

Immediately upgrade to a patched version of Coder: 2.29.19, 2.32.9, 2.33.10, or 2.34.4 or later. There are no workarounds; upgrading is required to close the vulnerability. Ensure all workspace agents and control planes are updated to prevent exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63443. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart