How Does Improper Hostname Validation in Coder Proxy Redirects Steal Workspace API Keys?

The short version

• Coder’s GetWorkspaceProxyByHostname function improperly validates hostnames using prefix matching.
• Domains starting with the same string as a proxy URL are trusted as legitimate proxies.
• This allows unauthenticated attackers to steal API keys from authenticated users.

The details

The National Vulnerability Database records CVE-2026-111927 as a high-severity issue with a CVSS score of 8.7. The flaw exists in Coder versions prior to 2.29.20, 2.33.12, 2.34.8 and 2.35.4. The vulnerability arises from improper hostname validation within the GetWorkspaceProxyByHostname function. Specifically, the SIMILAR TO pattern used for validation performs a simple prefix match.

This means any domain that begins with the same string as a workspace-proxy access URL is incorrectly trusted as a valid proxy. Attackers who own such a domain can exploit this trust. They lure an authenticated victim to a crafted /api/v2/applications/auth-redirect link. When the victim visits this link, the system redirects them, allowing the attacker to capture the application_connect API key. The attacker can then replay this key to access the victim’s workspace applications.

The context

This issue is classified under CWE-522. The flaw highlights the risks of relying on simple string matching for security-critical validations like hostname trust. By trusting any prefix match, the system fails to distinguish between legitimate proxies and malicious domains that merely share a starting string. This allows an attacker to intercept sensitive authentication tokens without needing to compromise the user’s password or session directly. The impact is significant because it grants access to workspace applications using the stolen API key.

Next steps

Organisations using affected Coder versions should verify their current release. Those running versions before 2.29.20, 2.33.12, 2.34.8 or 2.35.4 are exposed. Teams should plan to upgrade to the patched versions as soon as possible. Until then, monitoring for unusual redirect patterns or unexpected API key usage is advisable. Reviewing access logs for signs of credential replay can help detect potential exploitation.

What defenders should look for

Teams usually monitor for anomalous redirect chains involving authentication endpoints. Check whether internal proxies are receiving requests from unexpected external domains. Look for sudden spikes in API key usage from unfamiliar IP addresses or user agents. Verify that hostname validation logs show strict domain matching rather than prefix-based trust. Containment moves often involve blocking suspicious redirect URLs and revoking compromised API keys. Ensure that security alerts trigger on any deviation from expected proxy behaviour, particularly when involving workspace access tokens.

What to do and how to stay safe: Coder

• Audit your Coder version against the affected list and upgrade if necessary.
• Monitor logs for unexpected redirects to external domains sharing a prefix with your proxy URLs.
• Review API key usage patterns for signs of replay attacks or unauthorised access.
• Implement stricter hostname validation rules if possible before applying the vendor patch.

Step-by-step guide: How Virtual Patching Works: The Mechanics Behind Inline Protection

General security guidance from the Honeypot Daily newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which Coder versions are affected by CVE-2026-111927?

Versions before 2.29.20, 2.33.12, 2.34.8 and 2.35.4 are affected.

How do attackers exploit this flaw?

They use a crafted auth-redirect link to capture the application_connect API key from an authenticated victim.

What is the CVSS score for this vulnerability?

The CVSS score is 8.7, which is rated as high severity.