CVE-2026-126404

Name of the Vulnerable Software and Affected Versions Coder versions 2.28.0 through 2.29.23 Coder versions 2.30.0 through 2.34.15 Coder versions 2.35.0 through 2.36.10 Coder versions 2.37.0 through 2.37.7 Coder versions 2.38.0 through 2.38.3

Description Insufficient restrictions on the creation of new API keys allow a scoped API key or OAuth2 token with key-creation permissions to bypass scopes, allow lists, and expiry limits. By calling the 'POST /api/v2/users/{user}/keys/tokens' endpoint, an attacker can generate longer-lived keys with coder:all permissions, effectively gaining the full privileges of the user.

Recommendations Update Coder versions 2.28.0 through 2.29.23 to 2.29.24. Update Coder versions 2.30.0 through 2.34.15 to 2.34.16. Update Coder versions 2.35.0 through 2.36.10 to 2.36.11. Update Coder versions 2.37.0 through 2.37.7 to 2.37.8. Update Coder versions 2.38.0 through 2.38.3 to 2.38.4.