Remote Code Execution Vulnerability in Coder Product
CVE-2026-63443
What is CVE-2026-63443?
The vulnerability in Coder's workspace agent allows an authenticated user controlling a modified agent to exploit redirect responses from the HTTP API. By leveraging redirects, a malicious user can deduce the victim's tailnet address and redirect control-plane requests, leading to unauthorized access and the ability to execute commands on behalf of the victim. This issue impacts versions prior to 2.29.19, 2.32.9, 2.33.10, and 2.34.4, where proper validation mechanisms for redirects were not implemented, exposing systems to potential abuse of file read and write operations, and command execution across different workspaces and tenant environments.
Affected Version(s)
coder >= 2.27.0, < 2.29.19 < 2.27.0, 2.29.19
coder >= 2.30.0, < 2.32.9 < 2.30.0, 2.32.9
coder >= 2.33.0, < 2.33.10 < 2.33.0, 2.33.10