Unauthenticated Debug Server Exposes Credentials in Coder

Executive Summary

CVE-2026-111926 is an information disclosure vulnerability in Coder versions 2.10.0 to 2.34.7. The Coder agent runs an unauthenticated debug HTTP server on 127.0.0.1:2113 with a /debug/manifest endpoint that returns a full manifest, including environment variable values set by workspace templates. Lower-privileged Unix users or processes in the same workspace can query this endpoint to read sensitive credentials like cloud keys or registry tokens.

Useful 0 Not Useful 0

Detection Guidance

Check if the Coder agent debug server is running on localhost port 2113 by running: netstat -tulnp | grep 2113 or ss -tulnp | grep 2113. If active, query the /debug/manifest endpoint using curl http://127.0.0.1:2113/debug/manifest to see if environment variables are exposed. Ensure no sensitive values like cloud keys appear in the output.

Verify the Coder version with coder version. If it is between 2.10.0 and 2.34.7, the system is vulnerable.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows lower-privileged users within the same workspace to read sensitive environment variables injected by templates, such as cloud keys or registry tokens. It does not bypass authentication or allow cross-workspace access but exposes secrets to co-tenant users who could not otherwise access them. The impact is limited to information disclosure within the workspace.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA due to unauthorized access to sensitive environment variables such as cloud keys or registry tokens. GDPR requires protection of personal data, and HIPAA mandates safeguarding protected health information. Exposure of such credentials may violate these regulations by allowing unauthorized users within the same workspace to access sensitive data.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade the Coder agent to version 2.34.8 or later immediately. Avoid injecting secrets via template environment variables; use the workspace Secrets mechanism instead. Restrict access to the debug endpoint by ensuring no unnecessary processes can reach 127.0.0.1:2113.

Useful 0 Not Useful 0