Log in Start free

Vulnerability · Published Nov 4, 2026 · Assigned by VulnCheck

CVE-2026-121967Coder before 2.29.22, 2.34.13, 2.35.10, 2.36.8, 2.37.5, and 2.38.1 AI Gateway Path Traversal

Medium 4.9

In plain English

A medium-severity path traversal in coder from coder. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 17% of all known vulnerabilities).

Severity (CVSS 3.1)4.9Medium
Exploit odds (30 days)0.3%top 82.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Coder 2.28.0 before 2.29.22, 2.30.0 before 2.34.13, 2.35.0 before 2.35.10, 2.36.0 before 2.36.8, 2.37.0 before 2.37.5, and 2.38.0 before 2.38.1 contains a path traversal vulnerability in the AI Gateway passthrough router, which forwards percent-encoded dot segments upstream without rejecting them. Authenticated users can send paths such as %2e%2e or ..%2F under allowlisted prefixes to reach unintended provider endpoints using the deployment's centrally managed provider key.

Affected products (as reported)

VendorProductVersions
coder coder 2.37.0 – before 2.37.5
coder coder 2.36.0 – before 2.36.8
coder coder 2.35.0 – before 2.35.10
coder coder 2.30.0 – before 2.34.13
coder coder 2.28.0 – before 2.29.22
coder coder 2.38.0 – before 2.38.1

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N

References