CVE-2026-111931: Coder open redirect in workspace app proxy

CVE-2026-111931 · Severity: medium · CVSS 4.3 · Published 2026-10-17

Coder is a platform that provides remote development environments via web applications. An open redirect vulnerability in its workspace application proxy allows attackers to craft malicious links that redirect users from trusted Coder domains to attacker-controlled sites, facilitating phishing attacks. The vulnerability requires users to click a malicious link and only affects deployments with wildcard subdomain application routing enabled.

Technologies: Coder. Vendors: Coder.

Quick answers

Is CVE-2026-111931 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-111931 being exploited in the wild.
How severe is CVE-2026-111931?
Medium severity, with a CVSS score of 4.3, published 17 October 2026.
Which products and versions are affected?
Coder 2.0.0 through 2.34.7.
Is there a fix for CVE-2026-111931?
Yes: fixed in 2.34.8, 2.35.0, 2.36.0. Until then: As a workaround, use a reverse proxy or WAF rule in front of Coder to reject or rewrite inbound requests whose path begins with double slashes (//). Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-111931 attacked?
It is attacked over the network.
Am I affected by CVE-2026-111931?
Check whether you run Coder at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: 2.34.8, 2.35.0, 2.36.0

As a workaround, use a reverse proxy or WAF rule in front of Coder to reject or rewrite inbound requests whose path begins with double slashes (//).

Technical details

The handleAPIKeySmuggling function in coderd/workspaceapps/proxy.go fails to sanitize the redirect target, using an unsanitized r.URL.Path value directly in http.Redirect(). Attackers can exploit a gap in slash-normalization middleware by crafting URLs with double-slash paths (e.g., //attacker.example.com), which Go interprets as RFC 3986 scheme-relative URLs and redirects to the attacker's domain. This requires network access and user interaction (clicking a link) and is only exposed when wildcard subdomain routing is enabled.

Affected products

  • Coder Coder 2.0.0 through 2.34.7

Timeline

  • 2026-08-10: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.