CVE-2026-111927
Received Received - Intake

Improper Hostname Validation in Coder Workspace Proxy

Publication date: 2026-10-17

Last updated on: 2026-10-17

Assigner: VulnCheck

Description
Coder before 2.29.20, 2.33.0 before 2.33.12, 2.34.0 before 2.34.8, and 2.35.0 before 2.35.4 contains an improper hostname validation flaw in GetWorkspaceProxyByHostname whose SIMILAR TO pattern performs a prefix match, so any domain that is a string prefix of a workspace-proxy access URL is trusted as a proxy. Attackers owning such a domain can lure an authenticated victim to a crafted /api/v2/applications/auth-redirect link, capture the redirected application_connect API key, and replay it to access the victim's workspace apps.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-17
Last Modified
2026-10-17
Generated
2026-10-17
AI Q&A
2026-10-17
EPSS Evaluated
N/A
NVD
CVE-2026-111927
EUVD
EUVD-2026-103294

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
coder coder 2.35.0
coder coder 2.34.0
coder coder 2.33.0
coder coder 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-522 The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-111927 is an improper hostname validation flaw in Coder's GetWorkspaceProxyByHostname function. It uses a prefix match pattern instead of exact matching, allowing attackers who control a domain that is a prefix of a legitimate workspace-proxy URL to impersonate the proxy. This enables stealing API keys and accessing workspace applications.

Detection Guidance

To detect this vulnerability, check your Coder version against affected releases (2.35.0-2.35.3, 2.34.0-2.34.7, 2.33.0-2.33.11, or <2.29.20). Run 'coder version' to verify. Inspect network logs for suspicious /api/v2/applications/auth-redirect requests or API key exposure.

Impact Analysis

If you use an affected Coder version, attackers could trick you into clicking a malicious link. They could then steal your application_connect API key and use it to access your workspace applications without further authentication. This requires you to be authenticated and click the link.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, which may violate compliance requirements under GDPR (data protection) and HIPAA (health information privacy). Unauthorized access to workspace applications could expose personal or protected health information, resulting in regulatory penalties or breaches of confidentiality obligations.

Mitigation Strategies

Upgrade Coder to a patched version (2.35.4, 2.34.8, 2.33.12, or 2.29.20) immediately. If workspace proxies are unused, disable them. Monitor for unauthorized API key usage and revoke any exposed keys.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111927. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart