Authorization Bypass Vulnerability in Coder Product by Coder

CVE-2026-111929

What is CVE-2026-111929?

An authorization bypass vulnerability exists in the provisioner daemon's DownloadFile gRPC handler in the Coder software, allowing authenticated provisioner daemons to access and download cached Terraform module archives from other organizations. Attackers who possess an organization-scoped provisioner key and know the UUID of the file can exploit this vulnerability to retrieve sensitive module source code, which may disclose critical infrastructure information and embedded secrets, ultimately compromising data integrity and security across multiple organizations.

References