{"id":"GO-2026-5923","aliases":["GHSA-qrwj-vh9x-gw5v"],"title":"Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder","summary":"Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder","severity":"none","vendor":"coder","product":"github.com/coder/coder","ecosystem":"go","affected":["github.com/coder/coder","github.com/coder/coder/v2 >= 2.34.0, < 2.34.4"],"patched":["github.com/coder/coder/v2 2.34.4"],"published":"2026-07-07","updated":"2026-07-07","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GO-2026-5923","references":[{"url":"https://github.com/coder/coder/security/advisories/GHSA-qrwj-vh9x-gw5v"},{"url":"https://github.com/coder/coder/pull/26600"}],"tags":["osv","go"],"ingestedAt":"2026-07-09T18:56:37.259Z","slug":"GO-2026-5923","body":"## Overview\n\nCoder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder\n\n## Affected packages\n\n- `github.com/coder/coder`\n- `github.com/coder/coder/v2 >= 2.34.0, < 2.34.4`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `github.com/coder/coder/v2 2.34.4`","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}