---
id: CVE-2026-63443
title: >-
  Coder allows organizations to provision remote development environments via
  Terraform
summary: >-
  Coder allows organizations to provision remote development environments via
  Terraform. Prior to 2.29.19, 2.32.9, 2.33.10, and 2.34.4,
  agentConn.apiClient() follows redirects while its custom transport accepts the
  host from the redirected…
severity: high
cvss: 8.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L'
cwe:
  - CWE-863
  - CWE-918
vendor: coder
product: coder
affected:
  - 'coder >= 2.27.0, < 2.29.19'
  - 'coder >= 2.30.0, < 2.32.9'
  - 'coder >= 2.33.0, < 2.33.10'
  - 'coder >= 2.34.0, < 2.34.4'
published: '2026-09-15'
updated: '2026-09-15'
sourceUpdated: '2026-09-15T18:17:29.010'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-63443'
references:
  - url: >-
      https://github.com/coder/coder/commit/2312b67bc52c4e314c18c4b4be5dcf5500c94ad7
    label: security-advisories@github.com
  - url: >-
      https://github.com/coder/coder/commit/812549d671d0f5a0b45adcee860d37b70aaddccd
    label: security-advisories@github.com
  - url: >-
      https://github.com/coder/coder/commit/ec3ba84c0002f47dd979c073cde1ab345acbaea5
    label: security-advisories@github.com
  - url: >-
      https://github.com/coder/coder/commit/eeb2624549ddb85538e493af3e678fdb185a809f
    label: security-advisories@github.com
  - url: >-
      https://github.com/coder/coder/commit/f8bdec5add4711650d5bfb6ff93d0cc9d7821c81
    label: security-advisories@github.com
  - url: 'https://github.com/coder/coder/pull/26600'
    label: security-advisories@github.com
  - url: 'https://github.com/coder/coder/pull/26611'
    label: security-advisories@github.com
  - url: 'https://github.com/coder/coder/pull/26612'
    label: security-advisories@github.com
  - url: 'https://github.com/coder/coder/pull/26613'
    label: security-advisories@github.com
  - url: 'https://github.com/coder/coder/pull/26622'
    label: security-advisories@github.com
  - url: 'https://github.com/coder/coder/releases/tag/v2.29.19'
    label: security-advisories@github.com
  - url: 'https://github.com/coder/coder/releases/tag/v2.32.9'
    label: security-advisories@github.com
  - url: 'https://github.com/coder/coder/releases/tag/v2.33.10'
    label: security-advisories@github.com
  - url: 'https://github.com/coder/coder/releases/tag/v2.34.4'
    label: security-advisories@github.com
  - url: 'https://github.com/coder/coder/security/advisories/GHSA-qrwj-vh9x-gw5v'
    label: security-advisories@github.com
  - url: 'https://github.com/coder/coder'
tags:
  - nvd
  - cve.org
  - osv
  - go
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-09-15T17:31:25.407398Z'
ingestedAt: '2026-09-15T17:41:02.865Z'
aliases:
  - GHSA-qrwj-vh9x-gw5v
  - GO-2026-5923
ecosystem: go
patched:
  - github.com/coder/coder/v2 2.34.4
  - github.com/coder/coder/v2 2.33.10
  - github.com/coder/coder/v2 2.32.9
  - github.com/coder/coder/v2 2.29.19
epss: 0.00423
epssPercentile: 0.36092
---

## Overview

Coder allows organizations to provision remote development environments via Terraform. Prior to 2.29.19, 2.32.9, 2.33.10, and 2.34.4, agentConn.apiClient() follows redirects while its custom transport accepts the host from the redirected request URL when the port is the workspace agent HTTP API port 4. An authenticated user who controls a modified workspace agent and knows another online agent's UUID can derive the victim's tailnet address and redirect control-plane requests to that agent. HTTP 301, 302, and 303 redirects can redirect read requests, while HTTP 307 and 308 preserve replayable write and process-start requests. The redirected workspace agent file APIs can read or write files as the victim workspace user, and affected versions exposing the workspace agent process API can execute commands after a redirected file write, crossing workspace and tenant boundaries. This issue is fixed in versions 2.29.19, 2.32.9, 2.33.10, and 2.34.4.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-63443)

Affected packages:

- `github.com/coder/coder/v2 >= 2.34.0, < 2.34.4`
- `github.com/coder/coder/v2 >= 2.33.0, < 2.33.10`
- `github.com/coder/coder/v2 >= 2.30.0, < 2.32.9`
- `github.com/coder/coder/v2 >= 2.27.0, < 2.29.19`

Patched in:

- `github.com/coder/coder/v2 2.34.4`
- `github.com/coder/coder/v2 2.33.10`
- `github.com/coder/coder/v2 2.32.9`
- `github.com/coder/coder/v2 2.29.19`

Source: https://osv.dev/vulnerability/GHSA-qrwj-vh9x-gw5v