CVE-2026-111926Low· 3.3▾ SunlitCoder from 2.10.0 before 2.34.8 has an unauthenticated agent debug HTTP server on 127.0.0.1:2113 whose /debug/manifest handler returns the full agent manifest, including template-provided environment variable values. A lower-privileged U…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 18.2 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Coder from 2.10.0 before 2.34.8 has an unauthenticated agent debug HTTP server on 127.0.0.1:2113 whose /debug/manifest handler returns the full agent manifest, including template-provided environment variable values. A lower-privileged Unix user or process in the same workspace can query this endpoint to read credentials such as cloud keys or registry tokens.
coder >= 2.10.0 < 2.34.8Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-111930Medium· 4.3Coder from 2.26.0 before 2.34.8 Information Disclosure via Workspace ACL Endpoint
CVE-2024-58398Medium· 4.3Coder 2.3.1 before 2.16.1 Open Redirect via Login Page redirect Parameter
CVE-2025-71435Medium· 4.2Coder before 2.23.0 Session Expiration Bypass via OIDC Without Refresh Token
CVE-2026-111928Medium· 5.4Coder 2.0.0 before 2.34.8 Authorization Bypass via User-Level ACL in RBAC Policy
CVE-2026-111929Medium· 5.3Coder 2.30.0 before 2.34.8 Cross-Organization File Disclosure via DownloadFile RPC
CVE-2026-111931Medium· 4.3Coder 2.0.0 before 2.34.8 Open Redirect via Workspace App Proxy