Executive brief
A vulnerability in Coder's workspace agent allows a malicious user to trick the central control system into performing actions on other users' workspaces. By redirecting internal API requests, an attacker can read or write files and potentially execute unauthorized commands in another person's environment. This could lead to the theft of sensitive data or a complete takeover of workspaces belonging to different users or organizations.
Technical details
The Coder workspace agent API client (agentConn.apiClient) incorrectly followed HTTP redirects using the default Go http.Client behavior. Because agent tailnet IPs are deterministic based on agent UUIDs, a malicious agent could issue a 3xx redirect (specifically 307/308 which preserve request bodies) to point the control plane toward a victim agent's IP on port 4. Since the agent HTTP API on port 4 relies on tailnet reachability for authorization, this 'confused deputy' scenario allows an attacker to replay file API or process-start requests against a victim agent. This enables cross-tenant file access and remote code execution (RCE). The fix involves disabling automatic redirects and pinning the dialer to the intended agent's specific address.
Affected products
- Coder Coder >= 2.34.0, < 2.34.4; >= 2.33.0, < 2.33.10; >= 2.30.0, < 2.32.9; >= 2.27.0, < 2.29.19
Timeline
- 2026-06-23: patched: Fix merged into main branch
- 2026-07-01: disclosed: Initial advisory publication
- 2026-07-06: advisory: Advisory updated and reviewed