IP Spoofing in Coder Before 2.34.7

Executive Summary

CVE-2026-111934 is an IP spoofing vulnerability in Coder versions before 2.34.7. The ExtractRealIPAddress middleware incorrectly trusts the leftmost X-Forwarded-For header value provided by the client instead of the real client IP appended by a reverse proxy. Attackers can forge X-Forwarded-For values through proxy chains to bypass rate limits on login and password validation endpoints, enabling brute-force attacks and falsifying audit logs.

Useful 0 Not Useful 0

Detection Guidance

Check Coder version with 'coder version' command. Inspect HTTP headers in requests to Coder endpoints for X-Forwarded-For values that do not match expected proxy behavior. Monitor audit logs for IP addresses that appear inconsistent with network topology.

Useful 0 Not Useful 0

Impact Analysis

Attackers can bypass per-IP rate limits on authentication endpoints, allowing brute-force attacks on login, one-time passcodes, and password validation. It also enables falsification of IP addresses in audit logs, making it difficult to trace malicious activity. The impact is higher if Coder is deployed behind a reverse proxy with trusted headers.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by enabling falsification of IP addresses in audit logs. Attackers can manipulate recorded client IPs, potentially obscuring unauthorized access attempts or violating audit trail integrity requirements for both regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Coder to version 2.34.7 or later. If upgrading is not possible, configure trusted headers to use single-value alternatives like CF-Connecting-IP or True-Client-IP instead of X-Forwarded-For. Review and update proxy settings to ensure proper IP extraction.

Useful 0 Not Useful 0