Executive brief
Coder is a platform for provisioning remote development environments. An authenticated user who controls a malicious workspace agent can exploit HTTP redirects in the agent API client to intercept requests destined for other agents, allowing them to read/write files and execute commands as other users across tenant boundaries.
Technical details
The vulnerability is an insecure HTTP redirect handling flaw in the workspace agent API client (agentConn.apiClient()). The client followed HTTP 301, 302, 303, 307, and 308 redirects while accepting the hostname from the redirected request URL, even when the port matched the workspace agent HTTP API port 4. An authenticated attacker who controls a modified workspace agent and knows another agent's UUID can craft a redirect to bounce control-plane requests to a victim agent. This allows the attacker to access the victim agent's unauthenticated file APIs (read/write files) and process APIs (execute commands), crossing workspace and tenant isolation boundaries. The fix (versions 2.29.19, 2.32.9, 2.33.10, and 2.34.4) disables redirect following and pins all connections to the intended agent address.
Affected products
- Coder Coder prior to 2.29.19, 2.32.9, 2.33.10, and 2.34.4
Timeline
- 2026-09-15: disclosed