coder coder
productEUA product tracked in the threat graph; the vulnerabilities below are known to affect it.
0
KEV-listed
0
public exploit
0
EPSS ≥ 10%
0
unpatched
0
critical
by severity
0critical2high5medium0low
updated 2026-10-30
01
vulnerabilities (23)
Related CVEs.
| ID | severity | exploitable | ||||
|---|---|---|---|---|---|---|
| CVE-2026-44454US | high8.8 | — | ||||
Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7 and 2.30.2, the `dotfiles` registry module passed unsanitized user i… | ||||||
| CVE-2024-27918US | — | — | ||||
Coder allows oragnizations to provision remote development environments via Terraform. Prior to versions 2.6.1, 2.7.3, and 2.8.4, a vulnerability in Coder's OIDC authentication cou… | ||||||
| CVE-2026-55077US | — | — | ||||
Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, the `PUT /api/v2/users/{user}/password`… | ||||||
| CVE-2026-55079US | medium6.5 | — | ||||
Coder allows organizations to provision remote development environments via Terraform. Starting in version 2.24.0 and prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, `NewData… | ||||||
| CVE-2026-55076US | — | — | ||||
Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, Coder's OIDC callback checked `email_ve… | ||||||
| CVE-2026-55078US | — | — | ||||
Coder allows organizations to provision remote development environments via Terraform. Starting in version 2.17.0 and prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, `POST /a… | ||||||
| CVE-2026-55434US | — | — | ||||
Coder allows organizations to provision remote development environments via Terraform. Starting in version 2.33.0 and prior to versions 2.33.8 and 2.34.2, AI Bridge provider handle… | ||||||
| CVE-2026-55429US | — | — | ||||
Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, `UpsertWorkspaceApp` overwrites an exis… | ||||||
| CVE-2026-55075US | — | — | ||||
Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, two flaws in Coder's OIDC login chained… | ||||||
| CVE-2026-55427US | — | — | ||||
Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, `coder config-ssh` wrote server-supplie… | ||||||
| CVE-2026-45796US | — | — | ||||
Coder allows organizations to provision remote development environments via Terraform. Versions prior tp 2.24.5, 2.29.13, 2.30.8, 2.31.12, 2.32.2, and 2.33.3 are vulnerable to unau… | ||||||
| CVE-2026-55428US | —OT elevated | — | ||||
Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, the tailnet coordinator validates that… | ||||||
| CVE-2026-55433US | —OT elevated | — | ||||
Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, the devcontainer recreate endpoint reli… | ||||||
| CVE-2025-58437US | high8.1 | — | ||||
Coder allows organizations to provision remote development environments via Terraform. In versions 2.22.0 through 2.24.3, 2.25.0 and 2.25.1, Coder can be compromised through insec… | ||||||
| CVE-2026-55431US | medium6.1 | — | ||||
Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, `coder open app` opens external workspa… | ||||||
| CVE-2026-46354US | — | — | ||||
Coder allows organizations to provision remote development environments via Terraform. In versions prior tp 2.24.5, 2.29.13, 2.30.8, 2.31.12, 2.32.2, and 2.33.3, `azureidentity.Val… | ||||||
| CVE-2026-55437US | — | — | ||||
Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.17, 2.32.7, 2.33.8, and 2.34.2, the `AgentLogLine` dashboard component… | ||||||
| CVE-2026-55432US | —OT elevated | — | ||||
Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, the `CreateSubAgent` RPC did not valida… | ||||||
| CVE-2026-55435US | —OT elevated | — | ||||
Coder allows organizations to provision remote development environments via Terraform. Starting in version 2.30.0 and prior to versions 2.32.7, 2.33.8, and 2.34.2, AI Bridge proxy… | ||||||
| CVE-2026-55436US | — | — | ||||
Coder allows organizations to provision remote development environments via Terraform. Starting in version 2.30.0 and prior to versions 2.32.7, 2.33.8, and 2.34.2, the AI Bridge Pr… | ||||||
| CVE-2025-66411US | medium5.5 | — | ||||
Coder allows organizations to provision remote development environments via Terraform. Prior to 2.26.5, 2.27.7, and 2.28.4, Workspace Agent manifests containing sensitive values we… | ||||||
| CVE-2026-55438US | medium6.8 | — | ||||
Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.17, 2.32.7, 2.33.8, and 2.34.2, Coder's subdomain-based workspace app… | ||||||
| CVE-2026-55430US | medium6.8OT elevated | — | ||||
Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, the workspace app proxy resolves the ta… | ||||||
02
weaknesses (8)
The flaw types (CWEs) most of these CVEs share.
- CWE-285Improper Authorization2 CVEs
- CWE-287Improper Authentication2 CVEs
- CWE-770Allocation of Resources Without Limits or Throttling2 CVEs
- CWE-78Improper Neutralization of Special Elements used in an OS Command2 CVEs
- CWE-862Missing Authorization2 CVEs
- CWE-863Incorrect Authorization2 CVEs
- CWE-20Improper Input Validation1 CVEs
- CWE-269Improper Privilege Management1 CVEs
03
sources (1)
Which sources assert this record, and when.
- EUEU Vulnerability Database (ENISA)23 CVEs
scry
Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.
Free scan