Is CVE-2026-63443 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-63443 being exploited in the wild.

How severe is CVE-2026-63443?

High severity, with a CVSS score of 8.3, published 15 September 2026.

Which products and versions are affected?

Coder prior to 2.29.19, 2.32.9, 2.33.10, and 2.34.4; github.com/coder/coder (Go) SEMVER:introduced=0; github.com/coder/coder/v2 (Go) SEMVER:introduced=2.27.0,fixed=2.29.19,introduced=2.30.0,fixed=2.32.9,introduced=2.33.0,fixed=2.33.10,introduced=2.34.0,fixed=2.34.4, SEMVER:introduced=2.34.0,fixed=2.34.4.

Is there a fix for CVE-2026-63443?

Yes. github.com/coder/coder/v2 (Go): upgrade to 2.34.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-63443 attacked?

It is attacked over the network.

Am I affected by CVE-2026-63443?

Check whether you run Coder, github.com/coder/coder (Go) or github.com/coder/coder/v2 (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-63443: Coder HTTP redirect injection in workspace agent API

CVE-2026-63443 · Severity: high · CVSS 8.3 · Published 2026-09-15

Coder is a platform for provisioning remote development environments. An authenticated user who controls a malicious workspace agent can exploit HTTP redirects in the agent API client to intercept requests destined for other agents, allowing them to read/write files and execute commands as other users across tenant boundaries.

Technologies: Coder, github.com/coder/coder (Go), github.com/coder/coder/v2 (Go). Vendors: Coder, Go.

Quick answers

Is CVE-2026-63443 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-63443 being exploited in the wild.
How severe is CVE-2026-63443?: High severity, with a CVSS score of 8.3, published 15 September 2026.
Which products and versions are affected?: Coder prior to 2.29.19, 2.32.9, 2.33.10, and 2.34.4; github.com/coder/coder (Go) SEMVER:introduced=0; github.com/coder/coder/v2 (Go) SEMVER:introduced=2.27.0,fixed=2.29.19,introduced=2.30.0,fixed=2.32.9,introduced=2.33.0,fixed=2.33.10,introduced=2.34.0,fixed=2.34.4, SEMVER:introduced=2.34.0,fixed=2.34.4.
Is there a fix for CVE-2026-63443?: Yes. github.com/coder/coder/v2 (Go): upgrade to 2.34.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-63443 attacked?: It is attacked over the network.
Am I affected by CVE-2026-63443?: Check whether you run Coder, github.com/coder/coder (Go) or github.com/coder/coder/v2 (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/coder/coder/v2 (Go): upgrade to 2.34.4 or later
```
go get github.com/coder/coder/v2@v2.34.4
```

Technical details

The vulnerability is an insecure HTTP redirect handling flaw in the workspace agent API client (agentConn.apiClient()). The client followed HTTP 301, 302, 303, 307, and 308 redirects while accepting the hostname from the redirected request URL, even when the port matched the workspace agent HTTP API port 4. An authenticated attacker who controls a modified workspace agent and knows another agent's UUID can craft a redirect to bounce control-plane requests to a victim agent. This allows the attacker to access the victim agent's unauthenticated file APIs (read/write files) and process APIs (execute commands), crossing workspace and tenant isolation boundaries. The fix (versions 2.29.19, 2.32.9, 2.33.10, and 2.34.4) disables redirect following and pins all connections to the intended agent address.

Affected products

Coder Coder prior to 2.29.19, 2.32.9, 2.33.10, and 2.34.4

Identifiers

CVE-2026-63443
GHSA-qrwj-vh9x-gw5v
GO-2026-5923

Timeline

2026-09-15: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.