MEDIUM 4.8 NVD
CVE-2026-111926
Coder from 2.10.0 before 2.34.8 has an unauthenticated agent debug HTTP server on 127.0.0.1:2113 whose /debug/manifest handler returns the full agent manifest,
Coder from 2.10.0 before 2.34.8 has an unauthenticated agent debug HTTP server on 127.0.0.1:2113 whose /debug/manifest handler returns the full agent manifest, including template-provided environment variable values. A lower-privileged Unix user or process in the same workspace can query this endpoint to read credentials such as cloud keys or registry tokens.
References
- https://github.com/coder/coder/security/advisories/GHSA-73wg-wxvv-9r4j
- https://www.vulncheck.com/advisories/coder-from-2.10.0-before-2.34.8-information-disclosur
This medium severity vulnerability with a CVSS score of 4.8 was published on 2026-10-17 via NVD.
vulnfeed aggregates 16186 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.