CVE-2026-111927

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-111927", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-10-17T12:19:42.358Z", "datePublished": "2026-10-17T18:46:39.347Z", "dateUpdated": "2026-10-21T21:45:39.027Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-17T18:46:39.347Z"}, "datePublic": "2026-08-10T00:00:00.000Z", "title": "Coder before 2.35.4 Credential Theft via Workspace Proxy Hostname Prefix Match", "descriptions": [{"lang": "en", "value": "Coder before 2.29.20, 2.33.0 before 2.33.12, 2.34.0 before 2.34.8, and 2.35.0 before 2.35.4 contains an improper hostname validation flaw in GetWorkspaceProxyByHostname whose SIMILAR TO pattern performs a prefix match, so any domain that is a string prefix of a workspace-proxy access URL is trusted as a proxy. Attackers owning such a domain can lure an authenticated victim to a crafted /api/v2/applications/auth-redirect link, capture the redirected application_connect API key, and replay it to access the victim's workspace apps."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Insufficiently Protected Credentials", "cweId": "CWE-522", "type": "CWE"}]}], "affected": [{"vendor": "coder", "product": "coder", "defaultStatus": "unaffected", "packageURL": "pkg:golang/github.com/coder/coder/v2", "versions": [{"version": "2.35.0", "status": "affected", "versionType": "semver", "lessThan": "2.35.4"}, {"version": "2.35.4", "status": "unaffected", "versionType": "semver"}]}, {"vendor": "coder", "product": "coder", "defaultStatus": "unaffected", "packageURL": "pkg:golang/github.com/coder/coder/v2", "versions": [{"version": "2.34.0", "status": "affected", "versionType": "semver", "lessThan": "2.34.8"}, {"version": "2.34.8", "status": "unaffected", "versionType": "semver"}]}, {"vendor": "coder", "product": "coder", "defaultStatus": "unaffected", "packageURL": "pkg:golang/github.com/coder/coder/v2", "versions": [{"version": "2.33.0", "status": "affected", "versionType": "semver", "lessThan": "2.33.12"}, {"version": "2.33.12", "status": "unaffected", "versionType": "semver"}]}, {"vendor": "coder", "product": "coder", "defaultStatus": "unaffected", "packageURL": "pkg:golang/github.com/coder/coder/v2", "versions": [{"version": "0", "status": "affected", "versionType": "semver", "lessThan": "2.29.20"}, {"version": "2.29.20", "status": "unaffected", "versionType": "semver"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.35.0", "versionEndExcluding": "2.35.4"}]}]}, {"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.34.0", "versionEndExcluding": "2.34.8"}]}]}, {"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.33.0", "versionEndExcluding": "2.33.12"}]}]}, {"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*", "versionEndExcluding": "2.29.20"}]}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N", "attackVector": "NETWORK", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "baseScore": 8.7, "baseSeverity": "HIGH"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "LOW", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "NONE", "baseScore": 7.7, "baseSeverity": "HIGH"}}], "references": [{"url": "https://github.com/coder/coder/security/advisories/GHSA-h58h-qvv5-xvwg", "tags": ["vendor-advisory"], "name": "GitHub Security Advisory (GHSA-h58h-qvv5-xvwg)"}, {"name": "VulnCheck Advisory: Coder before 2.35.4 Credential Theft via Workspace Proxy Hostname Prefix Match", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/coder-before-2.35.4-credential-theft-via-workspace-proxy-hostname-prefix-match"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-21T21:45:28.936667Z", "id": "CVE-2026-111927", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-21T21:45:39.027Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-111927", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-21T21:45:28.936667Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-21T21:45:34.202Z"}}], "cna": {"title": "Coder before 2.35.4 Credential Theft via Workspace Proxy Hostname Prefix Match", "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 8.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N", "userInteraction": "PASSIVE", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH"}}, {"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "coder", "product": "coder", "versions": [{"status": "affected", "version": "2.35.0", "lessThan": "2.35.4", "versionType": "semver"}, {"status": "unaffected", "version": "2.35.4", "versionType": "semver"}], "packageURL": "pkg:golang/github.com/coder/coder/v2", "defaultStatus": "unaffected"}, {"vendor": "coder", "product": "coder", "versions": [{"status": "affected", "version": "2.34.0", "lessThan": "2.34.8", "versionType": "semver"}, {"status": "unaffected", "version": "2.34.8", "versionType": "semver"}], "packageURL": "pkg:golang/github.com/coder/coder/v2", "defaultStatus": "unaffected"}, {"vendor": "coder", "product": "coder", "versions": [{"status": "affected", "version": "2.33.0", "lessThan": "2.33.12", "versionType": "semver"}, {"status": "unaffected", "version": "2.33.12", "versionType": "semver"}], "packageURL": "pkg:golang/github.com/coder/coder/v2", "defaultStatus": "unaffected"}, {"vendor": "coder", "product": "coder", "versions": [{"status": "affected", "version": "0", "lessThan": "2.29.20", "versionType": "semver"}, {"status": "unaffected", "version": "2.29.20", "versionType": "semver"}], "packageURL": "pkg:golang/github.com/coder/coder/v2", "defaultStatus": "unaffected"}], "datePublic": "2026-08-10T00:00:00.000Z", "references": [{"url": "https://github.com/coder/coder/security/advisories/GHSA-h58h-qvv5-xvwg", "name": "GitHub Security Advisory (GHSA-h58h-qvv5-xvwg)", "tags": ["vendor-advisory"]}, {"url": "https://www.vulncheck.com/advisories/coder-before-2.35.4-credential-theft-via-workspace-proxy-hostname-prefix-match", "name": "VulnCheck Advisory: Coder before 2.35.4 Credential Theft via Workspace Proxy Hostname Prefix Match", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck-endgame"}, "descriptions": [{"lang": "en", "value": "Coder before 2.29.20, 2.33.0 before 2.33.12, 2.34.0 before 2.34.8, and 2.35.0 before 2.35.4 contains an improper hostname validation flaw in GetWorkspaceProxyByHostname whose SIMILAR TO pattern performs a prefix match, so any domain that is a string prefix of a workspace-proxy access URL is trusted as a proxy. Attackers owning such a domain can lure an authenticated victim to a crafted /api/v2/applications/auth-redirect link, capture the redirected application_connect API key, and replay it to access the victim's workspace apps."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-522", "description": "Insufficiently Protected Credentials"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "2.35.4", "versionStartIncluding": "2.35.0"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "2.34.8", "versionStartIncluding": "2.34.0"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "2.33.12", "versionStartIncluding": "2.33.0"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "2.29.20"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-17T18:46:39.347Z"}}}, "cveMetadata": {"cveId": "CVE-2026-111927", "state": "PUBLISHED", "dateUpdated": "2026-10-21T21:45:39.027Z", "dateReserved": "2026-10-17T12:19:42.358Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-10-17T18:46:39.347Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageURL": "pkg:golang/github.com/coder/coder/v2", "product": "coder", "vendor": "coder", "versions": [{"lessThan": "2.35.4", "status": "affected", "version": "2.35.0", "versionType": "semver"}, {"status": "unaffected", "version": "2.35.4", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "packageURL": "pkg:golang/github.com/coder/coder/v2", "product": "coder", "vendor": "coder", "versions": [{"lessThan": "2.34.8", "status": "affected", "version": "2.34.0", "versionType": "semver"}, {"status": "unaffected", "version": "2.34.8", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "packageURL": "pkg:golang/github.com/coder/coder/v2", "product": "coder", "vendor": "coder", "versions": [{"lessThan": "2.33.12", "status": "affected", "version": "2.33.0", "versionType": "semver"}, {"status": "unaffected", "version": "2.33.12", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "packageURL": "pkg:golang/github.com/coder/coder/v2", "product": "coder", "vendor": "coder", "versions": [{"lessThan": "2.29.20", "status": "affected", "version": "0", "versionType": "semver"}, {"status": "unaffected", "version": "2.29.20", "versionType": "semver"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Coder before 2.29.20, 2.33.0 before 2.33.12, 2.34.0 before 2.34.8, and 2.35.0 before 2.35.4 contains an improper hostname validation flaw in GetWorkspaceProxyByHostname whose SIMILAR TO pattern performs a prefix match, so any domain that is a string prefix of a workspace-proxy access URL is trusted as a proxy. Attackers owning such a domain can lure an authenticated victim to a crafted /api/v2/applications/auth-redirect link, capture the redirected application_connect API key, and replay it to access the victim's workspace apps."}, {"lang": "es", "value": "Coder en versiones anteriores a la 2.29.20, y en las ramas 2.33.0, 2.34.0 y 2.35.0 en versiones anteriores a la 2.33.12, 2.34.8 y 2.35.4 respectivamente, contiene un fallo de validaci\u00f3n de nombre de host inadecuada en GetWorkspaceProxyByHostname, cuyo patr\u00f3n SIMILAR TO realiza una coincidencia de prefijo, por lo que cualquier dominio que sea un prefijo de cadena de una URL de acceso de proxy de espacio de trabajo es de confianza como proxy. Los atacantes que poseen dicho dominio pueden atraer a una v\u00edctima autenticada a un enlace /API/v2/applications/auth-redirect manipulado, capturar la clave API application_connect redirigida y reproducirla para acceder a las aplicaciones del espacio de trabajo de la v\u00edctima."}], "id": "CVE-2026-111927", "lastModified": "2026-11-04T23:10:00.223", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 1.3, "impactScore": 5.8, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-111927", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-21T21:45:28.936667Z", "version": "2.0.3"}}]}, "published": "2026-10-17T19:16:35.527", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/coder/coder/security/advisories/GHSA-h58h-qvv5-xvwg"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/coder-before-2.35.4-credential-theft-via-workspace-proxy-hostname-prefix-match"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-522"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.35.0,2.35.4)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "2.35.4"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "coder", "source": "cna", "vendor": "coder"}, "product": "coder", "vendor": "coder"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.34.0,2.34.8)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "2.34.8"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "coder", "source": "cna", "vendor": "coder"}, "product": "coder", "vendor": "coder"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.33.0,2.33.12)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "2.33.12"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "coder", "source": "cna", "vendor": "coder"}, "product": "coder", "vendor": "coder"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,2.29.20)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "2.29.20"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "coder", "source": "cna", "vendor": "coder"}, "product": "coder", "vendor": "coder"}], "created": "2026-10-17T20:45:07.765973+00:00", "updated": "2026-10-20T10:15:13.104731+00:00", "vendors": ["coder", "coder$PRODUCT$coder"]}