CVE-2026-111927 is a high severity (CVSS 7.7) credential theft flaw in Coder. A prefix hostname match lets an attacker domain receive a victim's workspace app API key. Upgrade to 2.35.4, 2.34.8, 2.33.12 or 2.29.20, depending on your release line. The sections below cover affected versions, how to check, and what to do first.
What's affected
Coder before 2.29.20, 2.33.0 before 2.33.12, 2.34.0 before 2.34.8, and 2.35.0 before 2.35.4. The GitHub advisory lists patched versions 2.35.4, 2.34.8, 2.33.12 and 2.29.20. It says release lines 2.30 through 2.32 are end of life and will not get a patch, and that there is no configuration only workaround.
The attack needs a lure and an authenticated victim, which the vector reflects with required user interaction and high attack complexity.
Scoring note: the record's 7.7 is a CVSS 3.1 base score. VulnCheck's advisory also lists 8.7 under CVSS 4.0. Both describe the same flaw, and the two versions weigh the factors differently.
How to check if you're exposed
Check your version:
coder version
Compare it against the patched versions for your line. If you run 2.30, 2.31 or 2.32, you are on an end of life line and need to move to a supported one.
The advisory also mentions deployments that do not use workspace proxies, so check whether you configured any.
What to do now
- Check your Coder version and release line.
- Upgrade to the patched version for your line, or move off an end of life line.
- Review workspace proxy URLs configured in your deployment.
- Revoke and reissue workspace app API keys if you suspect a victim followed a hostile link.
- Teach users not to open unexpected auth redirect links.
- Scan your dependencies with the free in-browser scan and look the CVE up in the Gold directory to see where else it appears.
Do not stop at one host. Write down every place the affected software runs, including test servers, forgotten containers and copies bundled inside other products. Then rank them by exposure: anything reachable from the internet comes first, internal systems next. A short inventory now saves hours when the next advisory lands.
Why it matters
This is CWE-522, insufficiently protected credentials. The server validated a redirect target with a database SIMILAR TO pattern whose trailing delimiter was optional. That made any host that merely starts with a configured proxy hostname look legitimate.
The redirect carries an application_connect API key, so an attacker who owns a lookalike domain can capture it and replay it against the victim's workspace apps. The fix requires the host to match exactly, with only a port or path allowed after it. It is not listed in CISA KEV.
Quick check
Is there a workaround?
The advisory says there is no configuration only workaround. Upgrade.
What about versions 2.30 to 2.32?
The advisory says those lines are end of life and will not be patched.
Sources
Last reviewed: 18 October 2026.
