CVE-2026-111929 in Coder
Summary
by MITRE • 10/17/2026
Coder from 2.30.0 before 2.34.8 contains an authorization bypass vulnerability in the provisioner daemon DownloadFile gRPC handler that allows authenticated provisioner daemons to download other organizations' cached Terraform module archives. Attackers with an org-scoped provisioner key and a known file UUID can retrieve module source code exposing infrastructure topology or embedded secrets.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/17/2026
The vulnerability identified in Coder versions prior to 2.34.8 represents a critical authorization bypass within the provisioner daemon's DownloadFile gRPC handler. This flaw stems from an insufficient access control mechanism that fails to validate whether the requesting entity possesses permission to access specific resources belonging to other organizations. In a multi-tenant environment, such as those managed by Coder where distinct organizational boundaries are enforced for security and isolation purposes, this lack of strict tenant validation allows authenticated provisioner daemons to bypass logical separation controls. The core technical issue lies in the handler's reliance on the presence of valid authentication credentials rather than verifying that these credentials grant explicit rights to the specific file UUID being requested. Consequently, any daemon possessing a valid org-scoped provisioner key can interact with this endpoint without regard for organizational ownership boundaries.
The operational impact of this vulnerability is severe due to the sensitive nature of the data involved. By exploiting this flaw, an attacker who has obtained or compromised an organization-specific provisioner key and knows or can guess a file UUID associated with another tenant's infrastructure can retrieve cached Terraform module archives. These archives are not merely static files; they contain the source code for infrastructure-as-code definitions which often reveal detailed architectural diagrams, network topologies, database configurations, and potentially hardcoded secrets such as API keys, passwords, or cloud provider credentials embedded within configuration scripts. The exposure of this information provides a comprehensive view of an organization's digital footprint, facilitating further reconnaissance and increasing the risk of subsequent targeted attacks against exposed infrastructure components.
From a classification perspective, this vulnerability aligns with CWE-284 Improper Access Control, specifically reflecting failures in enforcing organizational or multi-tenant isolation boundaries. It also maps to MITRE ATT&CK techniques related to Collection and Exfiltration over C2 channels, as the gRPC interface serves as an unauthorized channel for data retrieval. The attack vector requires prior authentication but exploits a logical flaw rather than a cryptographic weakness, highlighting the importance of implementing robust authorization checks that verify resource ownership against user or service permissions at every access point.
To mitigate this vulnerability, organizations running Coder versions between 2.30.0 and 2.34.8 must upgrade to version 2.34.8 or later immediately upon availability. This update includes the necessary code changes to enforce strict authorization checks within the DownloadFile gRPC handler, ensuring that requests are validated against both authentication status and explicit organizational permissions before granting access to cached modules. In addition to upgrading, administrators should audit their provisioner key distribution practices to ensure keys are scoped strictly to required organizations and rotated regularly to limit the window of opportunity for exploitation if a key is compromised. Monitoring logs for unusual gRPC traffic patterns involving file downloads across different tenant IDs can also aid in detecting potential attempts to exploit this flaw before significant data loss occurs.