# CVE-2026-111927: Coder improper hostname validation in workspace proxy authentication

Source: https://junglewise.ai/threats/cve-2026-111927-coder-before-2-29-20-2-33-0-before-2-33-12-2-34-0-before-2-34-8  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-17. Updated: 2026-10-17  
License: CC BY 4.0 with a link back

CVE-2026-111927 · Severity: high · CVSS 7.7 · Published 2026-10-17

Coder is a platform that provides secure access to development workspaces and applications. A flaw in hostname validation allows an attacker who owns a domain matching a prefix of a workspace proxy URL to trick an authenticated user into visiting a malicious link, steal their API credentials, and replay those credentials to access the victim's workspace applications.

Technologies: [Coder](https://junglewise.ai/threats/technologies/coder). Vendors: [Coder](https://junglewise.ai/threats/vendors/coder).

## Quick answers

**Is CVE-2026-111927 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-111927 being exploited in the wild.

**How severe is CVE-2026-111927?** High severity, with a CVSS score of 7.7, published 17 October 2026.

**Which products and versions are affected?** Coder before 2.29.20, 2.33.0 before 2.33.12, 2.34.0 before 2.34.8, 2.35.0 before 2.35.4.

**Is there a fix for CVE-2026-111927?** Yes: fixed in 2.29.20, 2.33.12, 2.34.8, 2.35.4. Until then: Upgrade to a patched release; no configuration-only workaround exists. Deployments that do not use workspace proxies are not affected. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-111927 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-111927?** Check whether you run Coder at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 2.29.20, 2.33.12, 2.34.8, 2.35.4

Upgrade to a patched release; no configuration-only workaround exists. Deployments that do not use workspace proxies are not affected.

## Technical details

GetWorkspaceProxyByHostname uses a PostgreSQL SIMILAR TO pattern that performs prefix matching rather than exact hostname validation, allowing any domain that is a string prefix of a configured workspace-proxy access URL to be treated as trusted. An attacker owning such a domain can craft an /api/v2/applications/auth-redirect link, lure an authenticated victim to it, and receive an minted application_connect API key in the redirect. The key is not bound to the host it was issued for, permitting replay against the genuine proxy to obtain the victim's application credentials.

## Affected products

- Coder Coder before 2.29.20, 2.33.0 before 2.33.12, 2.34.0 before 2.34.8, 2.35.0 before 2.35.4

## Timeline

- 2026-08-10: disclosed
- 2026-10-17: advisory

## References

- [https://github.com/coder/coder/security/advisories/GHSA-h58h-qvv5-xvwg](https://github.com/coder/coder/security/advisories/GHSA-h58h-qvv5-xvwg)
- [https://www.vulncheck.com/advisories/coder-before-2.35.4-credential-theft-via-workspace-proxy-hostname-prefix-match](https://www.vulncheck.com/advisories/coder-before-2.35.4-credential-theft-via-workspace-proxy-hostname-prefix-match)

## Related threats

- [Coder AI Gateway encoded path traversal](https://junglewise.ai/threats/cve-2026-121967-coder-2-28-0-before-2-29-22-2-30-0-before-2-34-13-2-35-0-before)
- [Coder missing audience validation in GCP instance-identity endpoint](https://junglewise.ai/threats/cve-2026-118687-coder-before-2-29-21-2-30-0-before-2-34-12-2-35-0-before-2-35-9)
- [Coder open redirect in workspace app proxy](https://junglewise.ai/threats/cve-2026-111931-coder-from-2-0-0-before-2-34-8-contains-an-open-redirect)
- [Coder workspace ACL endpoint authorization bypass](https://junglewise.ai/threats/cve-2026-111930-coder-from-2-26-0-before-2-34-8-contains-an-incorrect)
- [Coder provisioner daemon authorization bypass in DownloadFile](https://junglewise.ai/threats/cve-2026-111929-coder-from-2-30-0-before-2-34-8-contains-an-authorization-bypass)