al-ice.ai

Everything After 10 August Is Invisible: Coder’s Nine Stranded Advisories and Eleven Retroactive CVEs

AI Vulnerabilities & CVEs by al-ice.ai Editorial

At 19:16:27.860Z on 17 October 2026, NVD began publishing eleven CVEs against Coder, the self-hosted remote development platform whose repository description reads, verbatim, “Secure environments for developers and their agents.” The last of the eleven landed at 19:16:36.497Z — an 8.6-second window, all assigned by disclosure@vulncheck.com, all still at vulnStatus: Received. The identifiers themselves are the first oddity: CVE-2024-58398, CVE-2025-71435, and CVE-2026-111926 through CVE-2026-111934. Three year-prefixes in one burst.

None of these are new vulnerabilities. Every one is a retroactive identifier for a Coder repository security advisory that the vendor published, correctly and with a shipped fix, without ever obtaining a CVE — the oldest of them almost two years ago. We traced all eleven through their NVD reference URLs to a GitHub advisory, and confirmed via the repository security-advisory API that all eleven of those advisories carry cve_id: null to this day.

That alone would be a modest housekeeping story. The reason it is not is what we found when we stopped looking at the eleven and swept all 37 of Coder’s repository advisories against the GitHub global advisory database and OSV.

A cutoff you can set your watch by

We queried every advisory ID against api.github.com/advisories/<GHSA> (the global database that feeds Dependabot) and against api.osv.dev/v1/vulns/<GHSA>. The result is not a scattering of gaps. It is a date:

  • All 28 advisories published from 4 March 2024 through 2 July 2026 return HTTP 200 in both — global database and OSV, with proper Go ecosystem coordinates on github.com/coder/coder/v2 and, in most cases, a GO-2026-xxxx Go vulnerability database alias.
  • All 9 advisories published from 10 August 2026 onward return HTTP 404 in both. Every single one.

The nine stranded records are GHSA-7v78-w67v-pm2g, GHSA-h58h-qvv5-xvwg, GHSA-73wg-wxvv-9r4j, GHSA-98qx-9p2x-c4wh, GHSA-cvrm-2xxr-hpcv and GHSA-hrhj-hpwc-9hmc (all 10 August), GHSA-vprw-xcrv-287h (11 August), GHSA-vx42-ghc9-gw65 (1 September, rated critical) and GHSA-24vh-q7rg-243w (13 October). Something in the path between Coder’s repository advisories and the global database stopped working between 2 July and 10 August 2026, and has not resumed since.

This inverts the scanner-gap story we have written repeatedly this month. In runwasi and Wheels, records were unfindable because the project had no coordinate any scanner could resolve. Coder has an excellent coordinate. It is a Go module, it is indexed, and OSV holds 20 Coder advisories with clean version ranges. The vulnerabilities here are invisible not because the ecosystem is unmapped but because nine correctly-written advisories never left the repository they were filed in.

The measurement that should worry operators

We asked OSV the question a dependency scanner actually asks — a package-version query for github.com/coder/coder/v2:

  • Version 2.34.0 → 40 records returned. Comprehensive, and none of them is any of the nine.
  • Version 2.20.0 → 40 records returned. Likewise.
  • Version 2.35.0 → zero records returned.

Zero is the dangerous answer, because 2.35.0 is explicitly named as affected by GHSA-h58h-qvv5-xvwg — the high-severity workspace-proxy credential theft, whose own affected range is >= 2.35.0, < 2.35.4. An operator running Coder 2.35.0 who scans with osv-scanner, Dependabot, or any commercial SCA keyed on these feeds gets a clean bill of health for a deployment the vendor has published a credential-theft advisory against, with a patch available since 10 August. The scanner is not broken and the configuration is not wrong. The record simply is not there to match.

GHSA-h58h: the prefix that was good enough

Of the nine, this is the one with real teeth, and it is worth reading because the defect is a single optional character in a SQL pattern. GetWorkspaceProxyByHostname validated a redirect target’s host with a PostgreSQL SIMILAR TO pattern, quoted from the advisory: '[^:]*://' || hostname || '([:/]?%)*'. Because the trailing delimiter group was optional — [:/]? rather than [:/] — the expression degraded from an exact-host match into a prefix match. The advisory’s own example: syd.co matched syd.coder-proxy.example.com.

The consequence, quoted: when an authenticated victim opens a crafted /api/v2/applications/auth-redirect?redirect_uri=... link, Coder “treats the attacker’s prefix domain as a trusted proxy, mints an application_connect-scoped API key for the victim, and 302-redirects the browser to the attacker’s domain with the encrypted key in the query string.” And then the detail that turns a leak into a takeover: “The key is not bound to the host it was issued for,” so the attacker replays the blob against the genuine proxy and obtains a cookie carrying the victim’s full-lifetime workspace-app credential. The fix makes the delimiter mandatory — ([:/]%)* — so a host that is merely a prefix no longer matches, while ports and paths still do.

One remediation caveat we verified rather than assumed. The advisory’s patch table names four backports: v2.35.4, v2.34.8, v2.33.12 and v2.29.20, with release lines 2.30 through 2.32 declared end-of-life and explicitly unpatched. Enumerating the repository’s tags, v2.35.4, v2.34.8 and v2.29.20 exist; v2.33.12 does not — public tags on the 2.33 line stop at v2.33.11. Operators pinned to 2.33 should confirm with Coder where that build lives before planning an upgrade against it.

CVE-2026-111926: the debug port inside the box you put the agent in

The lowest-rated of the eleven is the one that belongs in this feed. Coder’s workspace agent runs a debug HTTP server bound by default to 127.0.0.1:2113 — we confirmed the default in cli/agent.go at tag v2.34.0 — and it is unauthenticated. At the same tag, agent/agent.go registers r.Get("/debug/manifest", a.HandleHTTPDebugManifest), and the handler we read in full does exactly one interesting thing: json.NewEncoder(w).Encode(sdkManifest). The whole manifest, including the EnvironmentVariables map with its values, to anything that can open a loopback socket.

Coder rated it low, and the advisory states the reasoning plainly and fairly: “the same environment variables are already inherited by processes the owner runs,” so the practical impact is “disclosing template-set environment values to co-tenant Unix users who could not otherwise read the owner’s environment.” The dedicated Secrets store is not exposed. VulnCheck scored it 4.8 medium (CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N), CWE-200, affected >= 2.10.0, < 2.34.8.

We think the vendor’s threat model is correct for the product as it was built, and increasingly incomplete for the product as it is being sold. The reasoning holds because the owner’s own processes already inherit the environment — which is a statement about a human developer who typed the command. It reads differently when the long-running process in that workspace is an autonomous coding agent consuming untrusted repository content, issue text and web pages. A single curl http://127.0.0.1:2113/debug/manifest is an unremarkable-looking diagnostic command, it requires no privilege escalation, it touches no file the agent was told to avoid, and it returns the cloud keys and registry tokens the template injected. The boundary the advisory reasons about is the Unix user. The boundary operators think they are buying, from a vendor whose tagline is “environments for developers and their agents,” is the workspace. This is the same mismatch we described when Arcane’s delegated-admin CVEs turned permissions designed for junior staff into permissions handed to automation.

The fix, read first-hand, is small and good. PR #26904 by sreya, opened 2026-07-01T00:25:22Z and merged the same day at 15:46:35Z (+55/−1 across two files, 32 of the added lines being tests), redacts the values and preserves the keys. Its code comment states the threat model more bluntly than the severity rating does:

// Redact env values. This endpoint is unauthenticated on loopback,
// reachable by any process regardless of Unix user. Keys are preserved
// so operators can still see which variables are configured.

Empty values are preserved deliberately, “which carry no secret,” and the marker ***REDACTED*** is a named constant chosen to match sanitizeEnv in support/support.go — so a support bundle and this endpoint agree. We confirmed the redaction is still present on main at time of writing. Note the gap it closes is forty days wide on the disclosure side: the fix merged 1 July, the advisory published 10 August.

The rest of the eleven, briefly

  • CVE-2026-111928 (GHSA-7v78, medium, >= 2.0.0 < 2.34.8): the acl_allow rule in coderd/rbac/policy.rego checks organization membership for group ACL entries but not for per-user ones, and member removal does not scrub stale entries — so an offboarded user keeps API access to org-scoped templates and workspaces.
  • CVE-2026-111929 (GHSA-hrhj, medium, >= 2.30.0 < 2.34.8): the provisioner daemon DownloadFile gRPC handler serves other organizations’ cached Terraform module archives to anyone with an org-scoped provisioner key and a file UUID.
  • CVE-2026-111930 (GHSA-cvrm, medium, >= 2.26.0 < 2.34.8): GET /api/v2/workspaces/{id}/acl checks workspace read access, then fetches group members with an elevated system context — harvesting emails, login types and timestamps for low-privilege callers.
  • CVE-2026-111934 (GHSA-vprw, medium): ExtractRealIPAddress trusts the leftmost client-supplied X-Forwarded-For value, defeating per-IP rate limits on login and one-time-passcode endpoints and falsifying audit logs.
  • CVE-2026-111931 and CVE-2024-58398 are open redirects; CVE-2026-111932 is owner-role stored HTML injection into the dashboard and SMTP notifications; CVE-2026-111933 is login user enumeration via a placeholder hash derived from the string "hunter2"; CVE-2025-71435 is an API key outliving OIDC expiry when no refresh token is issued.
  • CVE-2026-111927 is GHSA-h58h, dissected above — the only high in the batch.

Worth noting for context: Coder’s June advisory batch, which did propagate normally, includes a dedicated AI Bridge cluster — CVE-2026-55436 (AI Bridge Proxy skips TLS certificate verification in default configuration, high), CVE-2026-55435 (suspended users retain access to the AI Bridge LLM proxy) and CVE-2026-55434. Those resolve in OSV today. The platform’s AI surface is being audited; the question this run raises is whether the findings reach anyone.

On the credits, and what we are not claiming

Six of the nine stranded advisories, and both older repo-only ones, credit “Anthropic’s Security Team” with reference identifiers in the form ANT-2026-22461, ANT-2026-22460, ANT-2026-22440, ANT-2026-22459, ANT-2026-22456, ANT-2026-22453, ANT-2026-22433 and ANT-2026-22432; GHSA-h58h additionally credits Adam Korczynski of Ada Logics for validating and reporting. That identifier format matches the one used on Anthropic’s public coordinated-disclosure dashboard, which describes using Claude models to find vulnerabilities in open-source software.

We checked that dashboard directly and found no entry for coder/coder and none of these ANT identifiers in its published ledger, which was last updated 2026-10-02 and states that it publishes only findings whose disclosure window has closed. We therefore do not claim these findings were model-discovered. What the primary sources support is narrower and still notable: Anthropic’s security team reported a cluster of issues in the platform that hosts coding agents, the vendor fixed and published them, and the records then failed to reach any feed.

What to do

  • Do not treat a clean Coder scan as evidence of anything right now. Nine vendor advisories — one critical — are absent from the global advisory database and OSV. Read the repository advisory list directly and diff it against whatever your tooling reports.
  • Prioritise GHSA-vx42-ghc9-gw65 first, not the new CVEs. It is the only critical in the set, it concerns malicious packages served from an unauthorized registry server, it affects everything below 2.37.0 with patches in 2.37.0, 2.36.4, 2.35.7 and 2.34.9 — and because VulnCheck’s backfill stopped at the August batch, it still has no CVE and no feed presence at all.
  • Upgrade, then stop putting secrets in template environment variables. 2.34.8 or later closes the manifest leak, but the advisory’s own workaround is the durable control: use the workspace Secrets mechanism, because template environment values are inherited by every process in the workspace — which now includes agents acting on untrusted input.
  • Re-derive org offboarding. CVE-2026-111928 means removing a user from an organization did not revoke per-user ACL grants. Audit existing ACL entries on org-scoped templates and workspaces against current membership; the stale grants persist after upgrading.
  • If you are on the 2.33 line, confirm your target build exists. The advisory names v2.33.12; the public tag list stops at v2.33.11.
  • Add “does the advisory propagate?” to your own release checklist. The generalisable lesson here is not about Coder’s code. A repository advisory that is never published to the global database is, from every consumer’s perspective, a private note. If you maintain software, request the CVE and verify the GHSA resolves at api.github.com/advisories/ after publication — it is a one-line check that Coder’s pipeline has been failing silently for 68 days.

Verification note: all eleven CVE identifiers, publication timestamps, CVSS vectors, CWEs, vulnStatus values, source identifiers and reference URLs were read first-hand from the NVD 2.0 API; the CVE-to-GHSA mapping was derived from those reference URLs. All 37 Coder repository advisories — summaries, descriptions, severities, CWEs, affected and patched version ranges, ecosystem coordinates, credits and publish timestamps — were read first-hand via the GitHub repository security-advisory API, and every quoted sentence is verbatim from those records. The global-database and OSV status of all 37 was measured directly, one HTTP request each, as were the OSV package-version queries for github.com/coder/coder/v2 at 2.20.0, 2.34.0 and 2.35.0. The /debug/manifest handler, its route registration and the 127.0.0.1:2113 default were read first-hand from agent/agent.go and cli/agent.go at tag v2.34.0; PR #26904 metadata and its complete diff, including the code comment quoted above, were read first-hand from the GitHub pulls and commits APIs, and the redaction constant was confirmed still present on main. Release tags, publish timestamps, the absence of a v2.33.12 tag, and repository metadata (17,063 stars, 1,636 forks, Go, AGPL-3.0, created 22 December 2021) are from the GitHub API. The VulnCheck advisory page for CVE-2026-111926 was read directly. Absence from CISA KEV was measured against catalog version 2026.10.16 (1,748 entries), which contains no Coder records of any kind; there is no evidence of exploitation of any issue described here. Anthropic’s coordinated-disclosure dashboard was fetched and searched directly. Brave Search was used for discovery only and returned no independent technical analysis of these records — solely automated CVE mirrors. Nothing was installed; no Coder deployment was created or contacted; no workspace, template, proxy or provisioner key was configured; no redirect link was crafted; no endpoint was queried; no proof-of-concept was executed. No third-party request was sent beyond reading the cited public records.

Sources: