Branches de versions concernées
Vulnérabilités connues
| CVE | Titre | Versions concernées | CVSS | Exploitée | EPSS | Publication |
|---|---|---|---|---|---|---|
| CVE-2026-126308 | Coder 2.38.0 before 2.38.2 Session Token Leak via Sub-Agent External Apps | ≥ 2.38.0 < 2.38.2 ≥ 2.37.0 < 2.37.6 ≥ 2.36.0 < 2.36.9 | 8.7 | — | 2026-11-13 | |
| CVE-2026-126403 | Coder 2.38.0 before 2.38.4 Authorization Bypass via External Agent Credentials Endpoint | ≥ 2.38.0 < 2.38.4 ≥ 2.37.0 < 2.37.8 ≥ 2.36.0 < 2.36.11 | 8.5 | 0.3% | 2026-11-13 | |
| CVE-2026-126404 | Coder from 2.38.0 before 2.38.4 Privilege Escalation via API Key Creation | ≥ 2.38.0 < 2.38.4 ≥ 2.37.0 < 2.37.8 ≥ 2.36.0 < 2.36.11 | 7.6 | 0.3% | 2026-11-13 | |
| CVE-2026-126405 | Coder from 2.38.0 before 2.38.4 Memory Exhaustion DoS via Web Push | ≥ 2.38.0 < 2.38.4 ≥ 2.37.0 < 2.37.8 ≥ 2.36.0 < 2.36.11 | 7.1 | — | 2026-11-13 | |
| CVE-2026-121967 | Coder before 2.29.22, 2.34.13, 2.35.10, 2.36.8, 2.37.5, and 2.38.1 AI Gateway Path Traversal | ≥ 2.37.0 < 2.37.5 ≥ 2.36.0 < 2.36.8 ≥ 2.35.0 < 2.35.10 | 2.3 | — | 2026-11-05 | |
| CVE-2026-118687 | Coder before 2.29.21, 2.34.12, 2.35.9, 2.36.7, and 2.37.4 Missing Audience Validation in GCP Instance-Identity... | ≥ 2.37.0 < 2.37.4 ≥ 2.36.0 < 2.36.7 ≥ 2.35.0 < 2.35.9 | 8.3 | — | 2026-10-29 | |
| CVE-2026-111934 | Coder before 2.34.7 IP Spoofing via X-Forwarded-For Header | < 2.34.7 | 6.3 | — | 2026-10-18 | |
| CVE-2026-111933 | Coder before 2.34.2 User Enumeration via Login Placeholder Hash | ≥ 2.34.0 < 2.34.2 ≥ 2.33.0 < 2.33.8 ≥ 2.30.0 < 2.32.7 | 6.3 | — | 2026-10-18 | |
| CVE-2026-111932 | Coder before 2.34.2 Stored HTML Injection via Appearance Settings | ≥ 2.34.0 < 2.34.2 ≥ 2.33.0 < 2.33.8 ≥ 2.30.0 < 2.32.7 | 4.8 | — | 2026-10-18 | |
| CVE-2026-111931 | Coder 2.0.0 before 2.34.8 Open Redirect via Workspace App Proxy | ≥ 2.0.0 < 2.34.8 | 5.3 | — | 2026-10-18 | |
| CVE-2026-111930 | Coder from 2.26.0 before 2.34.8 Information Disclosure via Workspace ACL Endpoint | ≥ 2.26.0 < 2.34.8 | 5.3 | — | 2026-10-18 | |
| CVE-2026-111929 | Coder 2.30.0 before 2.34.8 Cross-Organization File Disclosure via DownloadFile RPC | ≥ 2.30.0 < 2.34.8 | 6.0 | — | 2026-10-18 | |
| CVE-2026-111928 | Coder 2.0.0 before 2.34.8 Authorization Bypass via User-Level ACL in RBAC Policy | ≥ 2.0.0 < 2.34.8 | 5.3 | — | 2026-10-18 | |
| CVE-2026-111927 | Coder before 2.35.4 Credential Theft via Workspace Proxy Hostname Prefix Match | ≥ 2.35.0 < 2.35.4 ≥ 2.34.0 < 2.34.8 ≥ 2.33.0 < 2.33.12 | 8.7 | — | 2026-10-18 | |
| CVE-2026-111926 | Coder from 2.10.0 before 2.34.8 Information Disclosure via Agent /debug/manifest | ≥ 2.10.0 < 2.34.8 | 4.8 | — | 2026-10-18 | |
| CVE-2025-71435 | Coder before 2.23.0 Session Expiration Bypass via OIDC Without Refresh Token | < 2.23.0 | 2.3 | — | 2026-10-18 | |
| CVE-2024-58398 | Coder 2.3.1 before 2.16.1 Open Redirect via Login Page redirect Parameter | ≥ 2.16.0 < 2.16.1 ≥ 2.15.0 < 2.15.3 ≥ 2.3.1 < 2.14.4 | 5.3 | — | 2026-10-18 | |
| CVE-2026-63443 | Coder: Workspace agent API insecure redirect handling allowed cross-agent file read and write | * | 8.3 | — | 2026-09-16 | |
| CVE-2026-55438 | Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing | * | 5.8 | — | 2026-07-08 | |
| CVE-2026-55437 | Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component | * | 5.4 | — | 2026-07-08 | |
| CVE-2026-55436 | Coder's AI Bridge Proxy skips TLS certificate verification in default configuration | * | 7.4 | — | 2026-07-08 | |
| CVE-2026-55433 | Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers | * | 5.4 | — | 2026-07-08 | |
| CVE-2026-55432 | Coder's sub-agent app registration bypasses template port-sharing policy enforcement | * | 5.4 | — | 2026-07-08 | |
| CVE-2026-55431 | Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps | * | 7.7 | — | 2026-07-08 | |
| CVE-2026-55430 | Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app dat... | * | 5.8 | — | 2026-07-08 | |
| CVE-2026-55429 | Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID | * | 8.7 | — | 2026-07-08 | |
| CVE-2026-55428 | Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator | * | 8.2 | — | 2026-07-08 | |
| CVE-2026-55427 | Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` | * | 8.3 | — | 2026-07-08 | |
| CVE-2026-55079 | Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service | * | 4.9 | — | 2026-07-08 | |
| CVE-2026-55078 | Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service | * | 6.5 | — | 2026-07-08 | |
| CVE-2026-55077 | Coder: User-admin role can reset owner account password | * | 7.2 | — | 2026-07-08 | |
| CVE-2026-55076 | Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking | * | 7.4 | — | 2026-07-08 | |
| CVE-2026-55075 | Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass | * | 7.4 | — | 2026-07-08 | |
| CVE-2026-46354 | Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft | * | 9.1 | — | 2026-07-08 | |
| CVE-2026-45796 | Coder vulnerable to unauthenticated SSRF via Azure Instance Identity Endpoint | * | 6.5 | — | 2026-07-08 | |
| CVE-2026-44454 | Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent | * | 8.1 | — | 2026-07-08 | |
| CVE-2026-55434 | Coder vulnerable to denial of service via unbounded request body in AI Bridge provider endpoints | * | 6.5 | — | 2026-07-08 | |
| CVE-2026-55435 | Suspended Coder users retain access to AI Bridge LLM proxy endpoints | * | 5.4 | — | 2026-07-08 | |
| CVE-2025-66411 | Coder logged sensitive objects unsanitized | * | 7.8 | — | 2025-12-04 | |
| CVE-2025-58437 | Coder's privilege escalation vulnerability could lead to a cross workspace compromise | * | 8.1 | — | 2025-09-06 | |
| CVE-2024-27918 | Coder's OIDC authentication allows email with partially matching domain to register | * | 8.2 | — | 2024-03-07 |
Suivez ces versions sur vos propres serveurs
InfraGuard collecte les versions logicielles installées sur chaque serveur et signale celles qui présentent des vulnérabilités connues. Auto-hébergé : rien ne quitte votre réseau.
Données : CVE List (CVE® Program), NVD, CISA KEV, FIRST EPSS (voir EPSS sur https://www.first.org/epss), endoflife.date. Liste des logiciels : awesome-selfhosted (CC BY-SA 3.0).