Vulnerability · Published Sep 15, 2026 · Assigned by GitHub_M

CVE-2026-63443Coder: Workspace agent API insecure redirect handling allowed cross-agent file read and write

High 8.3

In plain English

A high-severity incorrect authorization in coder from coder. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 56% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.3High

Exploit odds (30 days)0.8%top 44.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Coder allows organizations to provision remote development environments via Terraform. Prior to 2.29.19, 2.32.9, 2.33.10, and 2.34.4, agentConn.apiClient() follows redirects while its custom transport accepts the host from the redirected request URL when the port is the workspace agent HTTP API port 4. An authenticated user who controls a modified workspace agent and knows another online agent's UUID can derive the victim's tailnet address and redirect control-plane requests to that agent. HTTP 301, 302, and 303 redirects can redirect read requests, while HTTP 307 and 308 preserve replayable write and process-start requests. The redirected workspace agent file APIs can read or write files as the victim workspace user, and affected versions exposing the workspace agent process API can execute commands after a redirected file write, crossing workspace and tenant boundaries. This issue is fixed in versions 2.29.19, 2.32.9, 2.33.10, and 2.34.4.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Go	github.com/coder/coder	no fix listed	GO-2026-5923
Go	github.com/coder/coder/v2	2.29.19, 2.32.9, 2.33.10, 2.34.4	GO-2026-5923
Go	github.com/coder/coder/v2	2.34.4	GHSA-qrwj-vh9x-gw5v
Go	github.com/coder/coder/v2	2.33.10	GHSA-qrwj-vh9x-gw5v
Go	github.com/coder/coder/v2	2.32.9	GHSA-qrwj-vh9x-gw5v
Go	github.com/coder/coder/v2	2.29.19	GHSA-qrwj-vh9x-gw5v

Affected products (as reported)

Vendor	Product	Versions
coder	coder	>= 2.27.0, < 2.29.19>= 2.30.0, < 2.32.9>= 2.33.0, < 2.33.10>= 2.34.0, < 2.34.4

Weakness: CWE-863, CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

References

https://github.com/coder/coder/security/advisories/GHSA-qrwj-vh9x-gw5v x_refsource_CONFIRM
https://github.com/coder/coder/pull/26600 x_refsource_MISC
https://github.com/coder/coder/pull/26611 x_refsource_MISC
https://github.com/coder/coder/pull/26612 x_refsource_MISC
https://github.com/coder/coder/pull/26613 x_refsource_MISC
https://github.com/coder/coder/pull/26622 x_refsource_MISC
https://github.com/coder/coder/commit/2312b67bc52c4e314c18c4b4be5dcf5500c94ad7 x_refsource_MISC
https://github.com/coder/coder/commit/812549d671d0f5a0b45adcee860d37b70aaddccd x_refsource_MISC
https://github.com/coder/coder/commit/ec3ba84c0002f47dd979c073cde1ab345acbaea5 x_refsource_MISC
https://github.com/coder/coder/commit/eeb2624549ddb85538e493af3e678fdb185a809f x_refsource_MISC
https://github.com/coder/coder/commit/f8bdec5add4711650d5bfb6ff93d0cc9d7821c81 x_refsource_MISC
https://github.com/coder/coder/releases/tag/v2.29.19 x_refsource_MISC
https://github.com/coder/coder/releases/tag/v2.32.9 x_refsource_MISC
https://github.com/coder/coder/releases/tag/v2.33.10 x_refsource_MISC
https://github.com/coder/coder/releases/tag/v2.34.4 x_refsource_MISC