Is CVE-2026-111927 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-111927 being exploited in the wild.

How severe is CVE-2026-111927?

High severity, with a CVSS score of 7.7, published 17 October 2026.

Which products and versions are affected?

Coder before 2.29.20, 2.33.0 before 2.33.12, 2.34.0 before 2.34.8, 2.35.0 before 2.35.4.

How is CVE-2026-111927 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-111927?

Check whether you run Coder at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-111927: Coder improper hostname validation in workspace proxy authentication

CVE-2026-111927 · Severity: high · CVSS 7.7 · Published 2026-10-17

Coder is a platform that provides secure access to development workspaces and applications. A flaw in hostname validation allows an attacker who owns a domain matching a prefix of a workspace proxy URL to trick an authenticated user into visiting a malicious link, steal their API credentials, and replay those credentials to access the victim's workspace applications.

Technologies: Coder. Vendors: Coder.

Quick answers

Is CVE-2026-111927 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-111927 being exploited in the wild.
How severe is CVE-2026-111927?: High severity, with a CVSS score of 7.7, published 17 October 2026.
Which products and versions are affected?: Coder before 2.29.20, 2.33.0 before 2.33.12, 2.34.0 before 2.34.8, 2.35.0 before 2.35.4.
Is there a fix for CVE-2026-111927?: Yes: fixed in 2.29.20, 2.33.12, 2.34.8, 2.35.4. Until then: Upgrade to a patched release; no configuration-only workaround exists. Deployments that do not use workspace proxies are not affected. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-111927 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-111927?: Check whether you run Coder at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 2.29.20, 2.33.12, 2.34.8, 2.35.4

Upgrade to a patched release; no configuration-only workaround exists. Deployments that do not use workspace proxies are not affected.

Technical details

GetWorkspaceProxyByHostname uses a PostgreSQL SIMILAR TO pattern that performs prefix matching rather than exact hostname validation, allowing any domain that is a string prefix of a configured workspace-proxy access URL to be treated as trusted. An attacker owning such a domain can craft an /api/v2/applications/auth-redirect link, lure an authenticated victim to it, and receive an minted application_connect API key in the redirect. The key is not bound to the host it was issued for, permitting replay against the genuine proxy to obtain the victim's application credentials.

Affected products

Coder Coder before 2.29.20, 2.33.0 before 2.33.12, 2.34.0 before 2.34.8, 2.35.0 before 2.35.4

Timeline

2026-08-10: disclosed
2026-10-17: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.