PkgSeer

Vulnerability GO-2026-5917

Unknown

2 months ago

Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

v0.1.0 - v0.27.3

Summary

Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

Details

Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access in github.com/coder/coder

References

Related Vulnerabilities

Other vulnerabilities affecting the same packages

Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings

v2.0.0 - v2.29.16 and v2.30.0 - v2.32.6 and v2.33.0 - v2.33.7 and v2.34.0 - v2.34.1 GHSA-h58c-xccx-75m3

Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison

v2.0.0 - v2.29.16 and v2.30.0 - v2.32.6 and v2.33.0 - v2.33.7 and v2.34.0 - v2.34.1 GHSA-8fxq-53rx-ph5f

Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

v2.17.0 - v2.29.16 GO-2026-5916

Coder: Zip upload decompression lacks aggregate size limit, enabling denial of service in github.com/coder/coder

v2.17.0 - v2.29.16 GO-2026-5916

Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing in github.com/coder/coder

v0.1.0 - v0.27.3 GO-2026-5918

View all vulnerabilities for these packages

Impacted packages

Timeline

Published

2 months ago

Last Modified

2 months ago