coder has 37 CVEs on record between 2024 and 2026. Cadence is steady at roughly 16 per quarter. The busiest recent month was July 2026 with 20. The median CVSS is 5.6 (medium). None have a confirmed exploitation report. The dominant weakness classes are CWE-863 (6) and CWE-601 (3). Most affected products: github.com/coder/coder/v2 (22), coder (12), github.com/coder/coder (3).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 5.6
- Publish → KEV
- —
- Last 90 days
- 16 prev 20
Products
- github.com/coder/coder/v2 22
- coder 12
- github.com/coder/coder 3
Worst active — by depth score
CVE-2026-55429High· 8.7Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID48CVE-2026-63443High· 8.3Coder allows organizations to provision remote development environments via Terraform46GHSA-qrwj-vh9x-gw5vHigh· 8.3Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write46CVE-2026-55427High· 8.3Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh`46CVE-2026-55428High· 8.2Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator45
coder vulnerabilities
CVEs affecting coder, newest first. Open any entry for full detail, references, and exploit status.
37 CVEsRSS
CVE-2026-55434Medium· 6.5Coder vulnerable to denial of service via unbounded request body in AI Bridge provider endpoints
Coder vulnerable to denial of service via unbounded request body in AI Bridge provider endpoints
CVE-2026-55435Medium· 5.4Suspended Coder users retain access to AI Bridge LLM proxy endpoints
Suspended Coder users retain access to AI Bridge LLM proxy endpoints
CVE-2026-55436High· 7.4Coder's AI Bridge Proxy skips TLS certificate verification in default configuration
Coder's AI Bridge Proxy skips TLS certificate verification in default configuration
CVE-2026-55437Medium· 5.4Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component
Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component
CVE-2026-55438Medium· 5.8Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing
Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing
CVE-2026-44454High· 8.1Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent
Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent
CVE-2024-27918High· 8.2Coder's OIDC authentication allows email with partially matching domain to register
Coder's OIDC authentication allows email with partially matching domain to register