Vulnerabilities in coder
40 resultsCVE-2026-55437MEDIUMCoder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine componentEPSS 0.3%CVE-2026-55435MEDIUMSuspended Coder users retain access to AI Bridge LLM proxy endpointsEPSS 0.3%CVE-2026-55432MEDIUMCoder's sub-agent app registration bypasses template port-sharing policy enforcementEPSS 0.3%CVE-2024-58398MEDIUMCoder 2.3.1 before 2.16.1 Open Redirect via Login Page redirect ParameterEPSS 0.3%CVE-2026-55436HIGHCoder's AI Bridge Proxy skips TLS certificate verification in default configurationEPSS 0.3%CVE-2026-121967LOWCoder before 2.29.22, 2.34.13, 2.35.10, 2.36.8, 2.37.5, and 2.38.1 AI Gateway Path TraversalEPSS 0.3%CVE-2025-66411HIGHCoder logged sensitive objects unsanitizedEPSS 0.2%CVE-2026-111933MEDIUMCoder before 2.34.2 User Enumeration via Login Placeholder HashEPSS 0.2%CVE-2026-55438MEDIUMCoder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofingEPSS 0.2%CVE-2026-55430MEDIUMCoder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data accessEPSS 0.2%CVE-2026-111927HIGHCoder before 2.35.4 Credential Theft via Workspace Proxy Hostname Prefix MatchEPSS 0.2%CVE-2026-111929MEDIUMCoder 2.30.0 before 2.34.8 Cross-Organization File Disclosure via DownloadFile RPCEPSS 0.2%CVE-2026-111930MEDIUMCoder from 2.26.0 before 2.34.8 Information Disclosure via Workspace ACL EndpointEPSS 0.2%CVE-2026-118687HIGHCoder before 2.29.21, 2.34.12, 2.35.9, 2.36.7, and 2.37.4 Missing Audience Validation in GCP Instance-Identity AuthenticationEPSS 0.2%CVE-2025-71435LOWCoder before 2.23.0 Session Expiration Bypass via OIDC Without Refresh TokenEPSS 0.2%CVE-2026-111932MEDIUMCoder before 2.34.2 Stored HTML Injection via Appearance SettingsEPSS 0.2%CVE-2026-111931MEDIUMCoder 2.0.0 before 2.34.8 Open Redirect via Workspace App ProxyEPSS 0.2%CVE-2026-111928MEDIUMCoder 2.0.0 before 2.34.8 Authorization Bypass via User-Level ACL in RBAC PolicyEPSS 0.1%CVE-2026-111934MEDIUMCoder before 2.34.7 IP Spoofing via X-Forwarded-For HeaderEPSS 0.1%CVE-2026-111926MEDIUMCoder from 2.10.0 before 2.34.8 Information Disclosure via Agent /debug/manifestEPSS 0.1%