CVE-2026-63443

Coder allows organizations to provision remote development environments via Terraform. Prior to 2.29.19, 2.32.9, 2.33.10, and 2.34.4, agentConn.apiClient() follows redirects while its custom transport accepts the host from the redirected request URL when the port is the workspace agent HTTP API port 4. An authenticated user who controls a modified workspace agent and knows another online agent's UUID can derive the victim's tailnet address and redirect control-plane requests to that agent. HTTP 301, 302, and 303 redirects can redirect read requests, while HTTP 307 and 308 preserve replayable write and process-start requests. The redirected workspace agent file APIs can read or write files as the victim workspace user, and affected versions exposing the workspace agent process API can execute commands after a redirected file write, crossing workspace and tenant boundaries. This issue is fixed in versions 2.29.19, 2.32.9, 2.33.10, and 2.34.4.

• CWE-863
• CWE-918

• https://github.com/coder/coder/commit/2312b67bc52c4e314c18c4b4be5dcf5500c94ad7
• https://github.com/coder/coder/commit/812549d671d0f5a0b45adcee860d37b70aaddccd
• https://github.com/coder/coder/commit/ec3ba84c0002f47dd979c073cde1ab345acbaea5
• https://github.com/coder/coder/commit/eeb2624549ddb85538e493af3e678fdb185a809f
• https://github.com/coder/coder/commit/f8bdec5add4711650d5bfb6ff93d0cc9d7821c81
• https://github.com/coder/coder/pull/26600
• https://github.com/coder/coder/pull/26611
• https://github.com/coder/coder/pull/26612
• https://github.com/coder/coder/pull/26613
• https://github.com/coder/coder/pull/26622
• https://github.com/coder/coder/releases/tag/v2.29.19
• https://github.com/coder/coder/releases/tag/v2.32.9
• https://github.com/coder/coder/releases/tag/v2.33.10
• https://github.com/coder/coder/releases/tag/v2.34.4
• https://github.com/coder/coder/security/advisories/GHSA-qrwj-vh9x-gw5v

Published

Sep 15, 2026

Last Modified

Sep 15, 2026

Status

Received

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-63429HeyForm is an open-source form builder. Prior to version 3.0…8.6
• CVE-2026-6343Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 1…4.3
• CVE-2026-63431Horilla is an HR and CRM software. In 1.5.0-85 and earlier, …6.5
• CVE-2026-63432Horilla is an HR and CRM software. From 1.0.0 until 1.6.0 an…6.5
• CVE-2026-63435Mail is an internet library for Ruby designed to handle emai…5.3
• CVE-2026-6344The Fluent Forms plugin for WordPress is vulnerable to Arbit…4.9
• CVE-2026-63445Perses is an open-source dashboard and visualization project…7.1
• CVE-2026-63446Suricata is a network Intrusion Detection System, Intrusion …7.5
• CVE-2026-63447Suricata is a network Intrusion Detection System, Intrusion …7.5
• CVE-2026-63448Suricata is a network Intrusion Detection System, Intrusion …5.9
• CVE-2026-63449Suricata is a network Intrusion Detection System, Intrusion …3.7
• CVE-2026-6345Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 1…6.5