CVE-2026-63443 in Coder
Summary
by MITRE • 09/15/2026
Coder allows organizations to provision remote development environments via Terraform. Prior to 2.29.19, 2.32.9, 2.33.10, and 2.34.4, agentConn.apiClient() follows redirects while its custom transport accepts the host from the redirected request URL when the port is the workspace agent HTTP API port 4. An authenticated user who controls a modified workspace agent and knows another online agent's UUID can derive the victim's tailnet address and redirect control-plane requests to that agent. HTTP 301, 302, and 303 redirects can redirect read requests, while HTTP 307 and 308 preserve replayable write and process-start requests. The redirected workspace agent file APIs can read or write files as the victim workspace user, and affected versions exposing the workspace agent process API can execute commands after a redirected file write, crossing workspace and tenant boundaries. This issue is fixed in versions 2.29.19, 2.32.9, 2.33.10, and 2.34.4.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/15/2026
The vulnerability identified in Coder prior to versions 2.29.19, 2.32.9, 2.33.10, and 2.34.4 represents a critical server-side request forgery flaw rooted in the improper handling of HTTP redirects within the agent connection logic. Specifically, the function agentConn.apiClient() utilizes a custom transport mechanism that inadvertently accepts the host from the URL of a redirected request when the destination port corresponds to the workspace agent HTTP API port 4. This behavior deviates from secure standards which dictate that redirect handlers should strictly validate and retain the original intended target or enforce strict allow-lists for redirection destinations, rather than blindly trusting the Host header provided by an intermediate server in a redirect chain. The flaw allows an authenticated user who controls a modified workspace agent to manipulate this flow effectively turning their controlled environment into a pivot point against other agents within the same Coder deployment.
The operational impact of this vulnerability is severe as it enables unauthorized access across tenant and workspace boundaries, which are typically designed to provide isolation between different users or projects. By leveraging HTTP status codes 301, 302, and 303, an attacker can redirect read requests to a victim's agent, allowing the exfiltration of sensitive data stored within that environment. More critically, through the use of HTTP 307 and 308 redirects which preserve the original request method including POST or PUT operations, attackers can execute write actions and process-start commands on behalf of the victim. This capability allows for arbitrary file writes to disk as the user running the workspace agent, which in turn facilitates remote code execution if the affected versions expose the workspace agent process API. The attacker must possess knowledge of another online agent's UUID to target a specific victim, but once obtained, the attack chain is straightforward and highly effective at bypassing standard authentication checks for cross-tenant operations.
From a classification perspective, this vulnerability aligns with CWE-918 Server-Side Request Forgery (SSRF) due to the manipulation of server-side HTTP requests based on unvalidated redirect inputs. It also relates to CWE-436 Interpretation Conflict as the client interprets the Host header from the redirected URL differently than intended by secure design principles, leading to unintended side effects in network routing and access control decisions. In terms of MITRE ATT&CK mapping, this behavior is consistent with T1598 Phishing for Information within a Multi-Tenant Environment or potentially T1072 Software Deployment Tools if the attacker uses the compromised agent to deploy further malicious payloads across the infrastructure. The ability to cross tenant boundaries elevates the severity significantly as it breaks the fundamental isolation guarantees provided by multi-tenant architectures, allowing lateral movement and privilege escalation that should not be possible through normal API interactions.
Mitigation strategies require immediate upgrading of all Coder instances to patched versions 2.29.19, 2.32.9, 2.33.10, or 2.34.4 where the redirect handling logic has been corrected to prevent acceptance of arbitrary hosts from redirected requests on port 4. Organizations should also audit their workspace agent configurations to ensure that only necessary APIs are exposed and implement strict network segmentation policies between workspaces wherever possible. Additionally, monitoring for unusual patterns in HTTP redirects originating from controlled agents can help detect exploitation attempts before significant damage occurs. Security teams must verify that no legacy versions remain in production environments as these continue to pose a direct risk of data exfiltration and remote code execution by authenticated attackers with control over at least one workspace agent.