Coder · product
coder
41 CVEs
Every dot is a CVE in what this vendor ships; the named ones are the most at risk.
Every one of the 41 is a mark on the map. Named now: 1 to 26, most at risk first.
- Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent
- Coder's OIDC authentication allows email with partially matching domain to register
- Coder: Workspace agent API insecure redirect handling allowed cross-agent file read and write
- Coder: User-admin role can reset owner account password
- Coder's unbounded memory allocation in provisioner file upload allows authenticated denial of service
- Coder's OIDC email_verified type coercion bypass enables account takeover via unverified email linking
- Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service
- Coder vulnerable to denial of service via unbounded request body in AI Bridge provider endpoints
- Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID
- Coder vulnerable to OIDC account takeover via email-based user matching and email_verified bypass
- Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh`
- Coder vulnerable to unauthenticated SSRF via Azure Instance Identity Endpoint
- Coder's privilege escalation vulnerability could lead to a cross workspace compromise
- Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator
- Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers
- Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps
- Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft
- Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component
- Suspended Coder users retain access to AI Bridge LLM proxy endpoints
- Coder's sub-agent app registration bypasses template port-sharing policy enforcement
- Coder 2.3.1 before 2.16.1 Open Redirect via Login Page redirect Parameter
- Coder's AI Bridge Proxy skips TLS certificate verification in default configuration
- Coder before 2.29.22, 2.34.13, 2.35.10, 2.36.8, 2.37.5, and 2.38.1 AI Gateway Path Traversal
- Coder logged sensitive objects unsanitized
- Coder before 2.34.2 User Enumeration via Login Placeholder Hash
- Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.