Skip to content
OpenAdvisories

Vendor

coder

40 known vulnerabilities.

Products

coder 37 agentapi 1 code-marketplace 1 code-server 1
All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Low 3.7
    CVE-2026-111934

    Coder before 2.34.7 IP Spoofing via X-Forwarded-For Header

    Coder before 2.34.7 contains an IP spoofing vulnerability in the ExtractRealIPAddress middleware that trusts the leftmost, client-supplied X-Forwarded-For value instead of the client IP appended by a reverse proxy. Attackers can send forged X-Forwarded-For va…

    coder coder
  • Low 3.7
    CVE-2026-111933

    Coder before 2.34.2 User Enumeration via Login Placeholder Hash

    Coder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before 2.34.2 contains a user enumeration vulnerability because userpassword.Compare() substitutes a placeholder hash derived from the string "hunter2" when a stored password hash is…

    coder coder github.com/coder/coder github.com/coder/coder/v2 Go
  • Low 3.4
    CVE-2026-111932

    Coder before 2.34.2 Stored HTML Injection via Appearance Settings

    Coder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before 2.34.2 contains a stored HTML injection vulnerability because the ApplicationName and LogoURL appearance settings are rendered into HTML output without sufficient escaping. At…

    coder coder github.com/coder/coder github.com/coder/coder/v2 Go
  • Low 3.3
    CVE-2026-111926

    Coder from 2.10.0 before 2.34.8 Information Disclosure via Agent /debug/manifest

    Coder from 2.10.0 before 2.34.8 has an unauthenticated agent debug HTTP server on 127.0.0.1:2113 whose /debug/manifest handler returns the full agent manifest, including template-provided environment variable values. A lower-privileged Unix user or process in…

    coder coder