Coder · weakness class
Access Control
15 CVEs
Every dot is a CVE in what this vendor ships; the named ones are the most at risk.
- likely to be exploited
- 1
Every one of the 15 is a mark on the map. Named now: 1 to 15, most at risk first.
- code-server session cookie can be extracted by having user visit specially crafted proxy URL
- Coder: Workspace agent API insecure redirect handling allowed cross-agent file read and write
- Coder: User-admin role can reset owner account password
- Coder's privilege escalation vulnerability could lead to a cross workspace compromise
- Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator
- Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers
- Coder 2.38.0 before 2.38.4 Authorization Bypass via External Agent Credentials Endpoint
- Versions of the package code-server before 4.10.1 are vulnerable to Missing Origin Validation in WebSockets handshakes. Exploiting this vulnerability can allow an adversary in spe…
- Suspended Coder users retain access to AI Bridge LLM proxy endpoints
- Coder's sub-agent app registration bypasses template port-sharing policy enforcement
- Coder from 2.38.0 before 2.38.4 Privilege Escalation via API Key Creation
- Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing
- Coder 2.30.0 before 2.34.8 Cross-Organization File Disclosure via DownloadFile RPC
- Coder before 2.29.21, 2.34.12, 2.35.9, 2.36.7, and 2.37.4 Missing Audience Validation in GCP Instance-Identity Authentication
- Coder 2.0.0 before 2.34.8 Authorization Bypass via User-Level ACL in RBAC Policy
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data. Use this via MCP