CVE-2026-63443: Coder Privilege Escalation Vulnerability

CVE-2026-63443 Overview

Coder is an open-source platform that provisions remote development environments through Terraform. CVE-2026-63443 is an authorization bypass vulnerability [CWE-863] in the agentConn.apiClient() function. The client follows HTTP redirects while its custom transport accepts the host from the redirected request URL when the port matches the workspace agent HTTP API port. An authenticated attacker who controls a modified workspace agent and knows another agent's UUID can redirect control-plane requests to a victim agent. This crosses workspace and tenant boundaries. Coder patched the issue in versions 2.29.19, 2.32.9, 2.33.10, and 2.34.4.

Critical Impact
An authenticated attacker can read or write files as the victim workspace user and, on affected versions exposing the workspace agent process API, execute commands across workspace and tenant boundaries.

Affected Products

Coder versions prior to 2.29.19
Coder versions prior to 2.32.9
Coder versions prior to 2.33.10 and 2.34.4

Discovery Timeline

2026-09-15 - CVE-2026-63443 published to the National Vulnerability Database (NVD)
2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-63443

Vulnerability Analysis

The flaw resides in the agentConn.apiClient() helper used by the Coder control plane (coderd) to talk to workspace agents over a Tailscale-based tailnet. The client's custom http.Transport was designed to dial the specific agent identified by its UUID. However, the transport also accepts the host component from a redirected request URL when the destination port equals the workspace agent HTTP API port. An authenticated user who runs a modified agent can respond to control-plane requests with a Location header pointing to another agent's tailnet address.

HTTP 301, 302, and 303 responses redirect read requests such as file downloads. HTTP 307 and 308 preserve the original method and body, allowing replay of write and process-start requests. The redirected requests then execute against the victim agent using the control plane's implicit trust, effectively impersonating server-to-agent calls across tenants.

Root Cause

The root cause is missing authorization enforcement between the intended agent UUID and the actual dial target after a redirect. The transport trusted redirect targets that shared the agent API port, decoupling authorization from the connection destination. The fix pins the API client to the intended agent so redirects cannot escape the original agent scope.

Attack Vector

Exploitation requires an authenticated Coder user with the ability to run a modified workspace agent and knowledge of a victim agent's UUID. From that UUID the attacker derives the victim's tailnet address, then returns crafted redirects to coderd requests. The result is unauthorized read or write access to files owned by the victim workspace user and, where the workspace agent process API is exposed, arbitrary command execution after a redirected file write.

// Patch: pin the workspace agent API client to the intended agent
// File: coderd/tailnet.go
conn = workspacesdk.NewAgentConn(s.conn, workspacesdk.AgentConnOptions{
    AgentID:   agentID,
    CloseFunc: func() error { return workspacesdk.ErrSkipClose },
    Logger:    s.logger,
})

// Since we now have an open conn, be careful to close it if we error

Source: GitHub Commit 2312b67

Detection Methods for CVE-2026-63443

Indicators of Compromise

Control-plane logs showing HTTP 301, 302, 303, 307, or 308 responses returned by workspace agents to coderd requests.
Workspace agent file API access (/api/v0/files) or process-start API calls originating from agents whose UUID does not match the requesting user's owned workspace.
Unexpected tailnet connections between agents belonging to different tenants or organizations.

Detection Strategies

Inspect coderd audit logs for API calls whose target agent UUID differs from the resolved tailnet peer address after a redirect.
Alert on any workspace agent that returns redirect status codes to control-plane API paths; legitimate agents should not issue such responses.
Correlate file read/write and process-start events on workspace agents with the initiating user identity to detect cross-tenant access.

Monitoring Recommendations

Enable verbose coderd logging so the newly added Logger field on AgentConnOptions records redirected agent dial attempts.
Forward Coder audit and agent logs to a centralized SIEM and retain them for cross-workspace correlation.
Monitor the Coder deployment version in inventory tools to confirm all instances run a patched release.

How to Mitigate CVE-2026-63443

Immediate Actions Required

Upgrade Coder to 2.29.19, 2.32.9, 2.33.10, or 2.34.4, matching your current release branch.
Rotate workspace agent tokens after upgrade to invalidate any credentials that may have been exposed to a redirected request.
Review audit logs for prior cross-workspace file or process API activity and investigate suspect users who ran custom agents.

Patch Information

Coder released fixes in the following versions: v2.29.19, v2.32.9, v2.33.10, and v2.34.4. The fix pins the API client to the intended agent UUID and prevents redirects from re-targeting another agent. Full technical detail is documented in GitHub Security Advisory GHSA-qrwj-vh9x-gw5v and pull requests #26600, #26611, #26612, #26613, and #26622.

Workarounds

Restrict who can register or modify workspace agents; limit template editing permissions to trusted administrators.
Disable or gate the workspace agent process API where it is not required, reducing the impact to file read/write only.
Segment tenants across separate Coder deployments until all instances are upgraded to a patched release.

bash

# Verify the running Coder server version matches a patched release
coder version

# Example upgrade using the official installer
curl -L https://coder.com/install.sh | sh -s -- --version 2.34.4

# Restart the Coder service after upgrade
sudo systemctl restart coder