{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3acodercoder/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.7,"id":"CVE-2026-111927"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Coder (\u003c 2.29.20, \u003e= 2.33.0 \u003c 2.33.12, \u003e= 2.34.0 \u003c 2.34.8, \u003e= 2.35.0 \u003c 2.35.4)"],"_cs_severities":["high"],"_cs_tags":["web-application","authentication-bypass","cve-2026-111927"],"_cs_type":"advisory","_cs_vendors":["Coder"],"content_html":"\u003cp\u003eCoder versions prior to 2.29.20, 2.33.12, 2.34.8, and 2.35.4 contain a critical vulnerability in the GetWorkspaceProxyByHostname function. The application uses a SIMILAR TO pattern that performs an insecure prefix match for hostname validation. This flaw allows an attacker to register or control a malicious domain that is a string prefix of a legitimate workspace-proxy access URL. By luring an authenticated victim into clicking a specially crafted link pointing to /api/v2/applications/auth-redirect, an attacker can capture sensitive application_connect API keys. These captured keys can then be replayed to gain unauthorized access to the victim's workspace applications, potentially resulting in full workspace compromise and lateral movement within the development environment.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for the theft of workspace-specific API keys. An attacker with these credentials can impersonate the victim, gain unauthorized access to workspace applications, and potentially exfiltrate sensitive source code, development environment secrets, or interact with cloud resources configured within the workspace.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eUpgrade all Coder installations to the patched versions: 2.29.20, 2.33.12, 2.34.8, or 2.35.4 or later.\u003c/li\u003e\n\u003cli\u003eImplement strict domain allowlisting for workspace-proxy access URLs to mitigate potential prefix collision attacks.\u003c/li\u003e\n\u003cli\u003eAudit existing Coder API keys for unauthorized usage patterns if the environment was exposed during the period preceding the patch.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-10-17T20:54:17Z","date_published":"2026-10-17T20:54:17Z","id":"https://feed.craftedsignal.io/briefs/2026-10-coder-hostname-validation/","summary":"Coder versions prior to 2.29.20, 2.33.12, 2.34.8, and 2.35.4 are vulnerable to an improper hostname validation flaw, allowing attackers to intercept workspace API keys via crafted redirect links.","title":"Improper Hostname Validation in Coder Workspace Proxy","url":"https://feed.craftedsignal.io/briefs/2026-10-coder-hostname-validation/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}