MEDIUM 6.0 NVD
CVE-2026-111929
Coder from 2.30.0 before 2.34.8 contains an authorization bypass vulnerability in the provisioner daemon DownloadFile gRPC handler that allows authenticated pro
Coder from 2.30.0 before 2.34.8 contains an authorization bypass vulnerability in the provisioner daemon DownloadFile gRPC handler that allows authenticated provisioner daemons to download other organizations' cached Terraform module archives. Attackers with an org-scoped provisioner key and a known file UUID can retrieve module source code exposing infrastructure topology or embedded secrets.
References
- https://github.com/coder/coder/security/advisories/GHSA-hrhj-hpwc-9hmc
- https://www.vulncheck.com/advisories/coder-2.30.0-before-2.34.8-cross-organization-file-di
This medium severity vulnerability with a CVSS score of 6.0 was published on 2026-10-17 via NVD.
vulnfeed aggregates 16186 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.