GPU VulnDB

Database/Control plane, storage & DevOps

Coder: workspace agent redirects let one tenant read, write and execute in another's workspace

CVSS 8.3CVE-2026-63443Control plane, storage & DevOpscurated

Impact

The control plane's workspace agent client follows HTTP redirects and accepts the host from the redirected URL whenever the port is the workspace agent API port. A user who controls a modified agent in their own workspace, and who knows another online agent's UUID, can derive the victim's tailnet address and point control-plane requests at it. 301/302/303 redirect read requests; 307/308 preserve the body, so writes and process-start calls are replayed against the victim. The result is file read and write as the victim workspace user, and on versions exposing the agent process API, command execution after a redirected write - a workspace and tenant boundary crossing. Where Coder hands out GPU-backed dev workspaces this means one tenant reaching another tenant's code, data and credentials on shared accelerator hosts.

Who can reach it

An authenticated Coder user who can run a modified workspace agent in a workspace they own and who knows or can guess another online agent's UUID. No operator or admin privileges needed.

What to do

Upgrade Coder to 2.29.19, 2.32.9, 2.33.10 or 2.34.4 depending on your release line. This is a control-plane (coderd) upgrade and restart; workspaces and their agents reconnect, so schedule it as a short control-plane outage rather than a node drain. If you cannot upgrade immediately, disabling the workspace agent process API removes the command-execution step but not the file read/write exposure.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-63443https://github.com/coder/coder/commit/2312b67bc52c4e314c18c4b4be5dcf5500c94ad7https://github.com/coder/coder/commit/812549d671d0f5a0b45adcee860d37b70aaddccdhttps://github.com/coder/coder/commit/ec3ba84c0002f47dd979c073cde1ab345acbaea5

Related entries

All Control plane, storage & DevOps entries

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.