Path Traversal Vulnerability in Coder AI Gateway Router
CVE-2026-121967

2.3LOW

Key Information:

Vendor

Coder

Status
Coder
Vendor
CVE Published:
4 November 2026

What is CVE-2026-121967?

A path traversal vulnerability exists in the Coder AI Gateway passthrough router that allows authenticated users to bypass security measures. By exploiting percent-encoded dot segments in file paths, an attacker can navigate to unintended backend endpoints using the deployment’s centrally managed provider key. This could lead to unauthorized access to sensitive information if not effectively mitigated in affected versions.

Affected Version(s)

coder 2.37.0 < 2.37.5

coder 2.36.0 < 2.36.8

coder 2.35.0 < 2.35.10

References

https://github.com/coder/coder/security/advisories/GHSA-3...
vendor-advisory
https://github.com/coder/coder/pull/30178
patchissue-tracking
https://www.vulncheck.com/advisories/coder-before-2.29.22...
third-party-advisory

CVSS V4

Score:
2.3
Severity:
LOW
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.