CVE-2026-126308

Name of the Vulnerable Software and Affected Versions Coder versions 2.24.0 through 2.29.22 Coder versions 2.30.0 through 2.34.13 Coder versions 2.35.0 through 2.36.8 Coder versions 2.37.0 through 2.37.5 Coder versions 2.38.0 through 2.38.1

Description The web dashboard replaces the $SESSION TOKEN placeholder in external app URLs with a full-access API key without verifying if the app belongs to a sub-agent. This allows code running in a workspace to register a disguised sub-agent app using a custom protocol URL, which can lead to the owner's API key being sent to an attacker-controlled destination upon clicking.

Recommendations Update to version 2.29.23 or later. Update to version 2.34.14 or later. Update to version 2.36.9 or later. Update to version 2.37.6 or later. Update to version 2.38.2 or later.