CVE-2026-111926 in Coder
Summary
by MITRE • 10/17/2026
Coder from 2.10.0 before 2.34.8 has an unauthenticated agent debug HTTP server on 127.0.0.1:2113 whose /debug/manifest handler returns the full agent manifest, including template-provided environment variable values. A lower-privileged Unix user or process in the same workspace can query this endpoint to read credentials such as cloud keys or registry tokens.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/17/2026
The vulnerability identified involves an unauthenticated information disclosure flaw within Coder versions 2.10.0 through 2.34.8, specifically affecting the agent debug HTTP server bound to localhost on port 2113. This internal service is designed for diagnostic purposes and exposes a /debug/manifest endpoint that returns the complete configuration manifest of the running agent instance. While binding services to loopback interfaces typically restricts access to local processes only, this implementation fails to enforce any authentication or authorization checks on the debug endpoints themselves. Consequently, any process executing with user privileges within the same workspace environment can interact with this service and retrieve sensitive operational data without needing elevated permissions or valid credentials for the Coder platform itself.
The core technical flaw lies in the exposure of template-provided environment variable values through the manifest response. These variables often contain critical secrets such as cloud provider access keys, container registry tokens, database passwords, and other API authentication strings required by applications running within the workspace containers. Because these credentials are injected into the agent configuration at runtime to facilitate connectivity with external services, their exposure in plaintext via an unauthenticated HTTP endpoint creates a significant security gap. An attacker who gains shell access or code execution capabilities as any user within the workspace can simply issue an HTTP GET request to http://127.0.0.1:2113/debug/manifest and extract these secrets directly from the JSON response body, bypassing traditional perimeter defenses that focus on external network traffic rather than internal lateral movement.
From a threat modeling perspective, this vulnerability aligns with CWE-200, which classifies as Information Exposure, specifically detailing how sensitive information is accessible to unauthorized actors without proper access controls. It also maps closely to ATT&CK technique T1537, which involves extracting cloud credentials from instance metadata services or local configuration files for lateral movement and privilege escalation within a compromised environment. The impact of this flaw extends beyond simple data leakage; it enables an attacker who has achieved initial code execution in a low-privileged workspace to pivot into higher-value infrastructure by leveraging the stolen cloud keys or registry tokens. This could lead to unauthorized resource provisioning, deployment of malicious containers, or exfiltration of sensitive data stored in connected cloud services, effectively compromising the integrity and confidentiality of the broader organization's IT ecosystem.
Mitigation strategies must address both immediate remediation and long-term architectural improvements. The most effective solution is to upgrade Coder to version 2.34.8 or later, where this debug endpoint behavior has been corrected to require authentication or disabled entirely in production environments. For organizations unable to patch immediately, implementing network segmentation rules that restrict access to port 2113 from all non-essential processes can provide a temporary control layer, although this is difficult to enforce strictly within containerized workspaces due to shared kernel namespaces. Additionally, adopting secret management best practices such as using dynamic secrets or external vaults like HashiCorp Vault instead of injecting static credentials into environment variables would reduce the value of stolen data even if an endpoint were exposed. Regular auditing of workspace configurations and monitoring for unusual HTTP traffic on internal loopback interfaces can also aid in detecting exploitation attempts before significant damage occurs.