All tracked items across vulnerabilities, news, research, incidents, and regulatory updates.
vLLM, a system that runs large language models efficiently, has a vulnerability in versions before 0.24.0 where users can submit malicious regular expressions (patterns used to match text) through the structured_outputs.regex parameter that cause the system to hang indefinitely, making it unavailable to other users. The vulnerability exists because the regex patterns are sent directly to backend compilers without checking if they will take too long to process, and patterns with nested quantifiers (like repeated matching operations inside each other) can cause exponential state-space expansion (the number of possible states the regex checker must evaluate grows exponentially). An attacker could exploit this to perform a denial-of-service attack (making a service unavailable to legitimate users).
Fix: Update vLLM to version 0.24.0 or later, where this issue is fixed.
NVD/CVE DatabasevLLM is a library for running and serving large language models (LLMs, AI systems that generate text). Versions 0.12.0 through 0.23.x have a bug where sending certain specially crafted requests to the /v1/completions endpoint (an API route for generating text) with models using M-RoPE (a rotary position embedding technique) causes the server to crash and stop working entirely, and any authorized user can trigger this crash.
vLLM (a system for running LLMs efficiently) versions before 0.24.0 have a bug where certain requests can cause the rejection sampler (a component that filters generated tokens) to produce an invalid token value that crashes the engine's GPU worker. Because these requests can be sent remotely through public endpoints, an attacker can trigger this crash to shut down the service for all users until the worker restarts, creating a denial of service attack (making a service unavailable to legitimate users).
Coder's workspace app had a security flaw where CORS (cross-origin resource sharing, a browser security feature that controls which websites can access each other's data) checks could be bypassed by using a UUID (universally unique identifier, a standardized format for unique IDs) in a subdomain to trick the system into trusting an attacker's username. An authenticated attacker could craft a malicious URL that, if visited by a victim while logged in, would allow the attacker's code to steal data from the victim's workspace apps.
Coder's AgentLogLine dashboard component failed to escape HTML characters before displaying workspace agent logs, allowing a workspace owner to inject arbitrary HTML that would render in other users' browsers when they viewed the workspace page. While a Content Security Policy blocked inline scripts, attackers could still inject redirects or CSS-based attacks.
Coder's AI Bridge Proxy had a security flaw where it disabled TLS certificate verification (the process that confirms a server's identity over encrypted connections) in its default configuration, meaning it would accept any certificate from the Coder server. An attacker positioned between the proxy and server could intercept sensitive data like session tokens and API keys. This only affects systems where the proxy and server are on separate machines; co-located systems using loopback connections are unaffected.
A security flaw in Coder's AI Bridge (a proxy for accessing LLM services) allowed suspended users to keep using their existing API keys (authentication tokens) because the system didn't check if an account was suspended, only if the key itself was valid. This meant a suspended user could continue making expensive AI requests until their token expired, which could be months later.
Coder's AI Bridge provider endpoints had a vulnerability where they read incoming request bodies without limiting their size, allowing an authenticated user to send extremely large requests that consume all available memory and crash the system (denial of service, a type of attack that makes a service unavailable). This vulnerability only affects versions 2.33 and 2.34 and requires the attacker to already have authenticated access to the AI Bridge feature.
A bug in Coder's devcontainer recreate endpoint allowed users with read-only workspace access to destroy containers and cause service outages, because the endpoint only checked read permissions instead of also checking update permissions like similar endpoints do. Exploitation requires the attacker to already have low-privilege access to the target workspace.
A security flaw in Coder allowed workspace owners to register sub-agent apps (helper programs running within a workspace) at a higher sharing level than administrators allowed, potentially exposing apps to unauthenticated users. The bug bypassed the template's MaxPortSharingLevel setting, which is a policy that controls how widely accessible workspace apps can be.
The `coder open app` command (a tool that opens external applications linked to workspaces) was vulnerable to leaking session tokens (secret credentials that prove a user's identity) to attacker-controlled websites. When a workspace's external app URL contained a `$SESSION_TOKEN` placeholder, the command would replace it with the real token before opening the URL, potentially sending it to an attacker's server if they controlled the workspace's app definitions. This could allow an attacker to impersonate the user and access their account.
A vulnerability in Coder's file upload feature allows an authenticated user to crash the service by uploading a specially crafted zip file containing many highly compressed entries that consume excessive memory during decompression. The zip file stays under the 100 MiB upload limit, but when decompressed in memory, it exhausts available memory and causes a denial of service (making the service unavailable), though it cannot leak data or execute code.
Coder's workspace app routing trusts an unauthenticated HTTP header called X-Forwarded-Host (a header that tells the server what hostname the request came for) without verifying it came from a trusted source. An attacker can set this header in their browser to trick the server into routing requests to a victim's private app while still using the victim's authentication cookies (session identifiers), allowing the attacker to read data from that private app. This only works if subdomain app routing (using wildcard hostnames to serve multiple apps) is enabled and the upstream proxy doesn't remove this header.
Coder's tailnet coordinator (the server managing a private network) didn't validate that `AllowedIPs` (IP address ranges an agent claims to serve) matched the agent's identity, even though it did validate the agent's regular addresses. This let a malicious authenticated agent claim another agent's IP address and intercept traffic meant for that agent, such as web terminal sessions. Exploiting this required an authenticated user with a modified agent binary.
A vulnerability in Coder's workspace app system allows attackers with template authorship or external provisioner access to redirect another user's app traffic to their own workspace. The flaw occurs because the system doesn't properly verify that an app ID belongs to the correct workspace before rebinding it to a different agent (the component that handles connections). App IDs are publicly discoverable, making this attack feasible for privileged users.
A bug in Coder's file upload system allowed authenticated users to cause a denial of service (making a service unavailable) by sending a message with an extremely large declared file size, which the system would try to allocate into memory without checking if it was reasonable. An attacker could crash the entire Coder deployment with a single small message.
Coder's `coder config-ssh` command didn't properly check server-supplied SSH settings (HostnameSuffix, SSHConfigOptions) before writing them to the user's SSH configuration file, allowing a malicious or compromised server to inject arbitrary SSH configuration directives. An attacker controlling the server could inject commands like ProxyCommand to execute arbitrary code on a developer's workstation with that user's privileges.
A vulnerability in Coder allowed users with the `user-admin` role (a privileged account management permission) to reset the password of `owner` accounts (the highest-level administrators) without knowing the current password, potentially letting them take control of the entire deployment. This was a privilege escalation, where an attacker with lower-level admin access could gain full administrative control.
Coder had two OIDC (OpenID Connect, a login standard) security flaws that could let an attacker take over a user's account: the system matched users by email without checking if the email was already linked to a different identity provider, and it didn't properly verify the `email_verified` claim (a flag stating whether the email was confirmed). An attacker who could sign in at the configured OIDC provider with a matching email could log in as the victim and access their workspaces and resources.
Coder's OIDC (OpenID Connect, a login standard) authentication had a bug where it didn't properly check if an email was verified when the identity provider returned the verification status as a string or omitted it entirely, causing it to assume the email was verified by default. An attacker could use this flaw to take over someone's account by registering their email at a compatible identity provider without verifying it, then logging in through OIDC to gain access to the victim's Coder account.
Fix: This issue is fixed in version 0.24.0. Users should upgrade to vLLM version 0.24.0 or later.
NVD/CVE DatabaseFix: Update to vLLM version 0.24.0 or later, where this issue is fixed.
NVD/CVE DatabaseFix: Update to patched versions: v2.34.2, v2.33.8, v2.32.7, or v2.29.17 (depending on your release line). The fix validates that the subdomain username matches the actual workspace owner and bases CORS decisions on the real owner's identity instead of the unverified username in the URL.
GitHub Advisory DatabaseFix: The fix enables `escapeXML: true` in the `ansi-to-html` conversion so HTML metacharacters are escaped before being inserted into the page. Patched versions are available: v2.34.2, v2.33.8, v2.32.7, and v2.29.17 (ESR).
GitHub Advisory DatabaseFix: Apply the secure transport (TLS 1.2 or higher using system root CAs) unconditionally. Patched versions are available: v2.34.2 (for release line 2.34), v2.33.8 (for release line 2.33), and v2.32.7 (for release line 2.32). As a workaround, ensure the Coder access URL uses a trusted certificate and secure the network path between the AI Bridge Proxy and the Coder server, for example through loopback or mTLS (mutual TLS, where both sides verify each other's identity).
GitHub Advisory DatabaseFix: The fix is available in patched versions: v2.34.2, v2.33.8, and v2.32.7. As a workaround before updating, administrators can immediately delete a suspended user's API keys by calling `DELETE /api/v2/users/{user}/keys` to revoke their access.
GitHub Advisory DatabaseFix: The fix applies `http.MaxBytesReader` (a setting that caps the maximum size of incoming request data) or an equivalent limit before reading request bodies. Update to v2.34.2 or v2.33.8 depending on your release line.
GitHub Advisory DatabaseFix: Update to a patched version: v2.34.2 (for release line 2.34), v2.33.8 (for 2.33), v2.32.7 (for 2.32), or v2.29.17 (for ESR 2.29). The fix adds an explicit `ActionUpdate` authorization check before the devcontainer recreation is triggered, matching the security model of the delete endpoint.
GitHub Advisory DatabaseFix: Update to patched versions: v2.34.2, v2.33.8, v2.32.7, or v2.29.17 depending on your release line. The fix clamps the sub-agent app sharing level to the template's MaxPortSharingLevel. Alternatively, as a temporary workaround, disable wildcard app hostnames by setting `CODER_WILDCARD_ACCESS_URL` to disabled.
GitHub Advisory DatabaseFix: Update Coder to a patched version: v2.34.2 (for release line 2.34), v2.33.8 (for 2.33), v2.32.7 (for 2.32), or v2.29.17 (for 2.29 ESR). The fix applies a URL-scheme allowlist (a list of approved website protocols) in the CLI and limits session token substitution to trusted destinations like the web frontend. As a workaround, avoid running `coder open app` for untrusted workspaces.
GitHub Advisory DatabaseFix: Update to a patched version: v2.34.2, v2.33.8, v2.32.7, or v2.29.17 depending on your release line. The fix adds a preflight check that sums projected entry sizes before decompression and enforces an aggregate size limit during the decompression process. Alternatively, restrict file-upload permissions to trusted users only, or place a reverse proxy with request-body size limits in front of the Coder server.
GitHub Advisory DatabaseFix: Update to a patched version: v2.34.2, v2.33.8, v2.32.7, or v2.29.17 (for the extended support release). The fix makes the server trust X-Forwarded-Host only from configured trusted proxies and otherwise uses the verified request host for routing. As a temporary workaround if you cannot update immediately, place an upstream reverse proxy (a server that sits in front of Coder) that strips or overwrites the X-Forwarded-Host header on untrusted requests.
GitHub Advisory DatabaseFix: Upgrade to a patched version: v2.34.2 (for release line 2.34), v2.33.8 (for 2.33), v2.32.7 (for 2.32), or v2.29.17 (for ESR 2.29). The fix validates each `AllowedIPs` prefix against the authenticating agent's UUID, matching how `Addresses` are already validated. If you cannot upgrade immediately, monitor coordinator logs for agents advertising unexpected `AllowedIPs` prefixes.
GitHub Advisory DatabaseFix: Upgrade to a patched version: v2.34.2 (for release line 2.34), v2.33.8 (for 2.33), v2.32.7 (for 2.32), or v2.29.17 (for the ESR line 2.29). The patch adds verification to ensure that existing workspace app rows belong to the workspace being built and rejects attempts to reassign apps across workspaces. No workarounds are available, so upgrading is required.
GitHub Advisory DatabaseFix: Update to one of the patched versions: v2.34.2, v2.33.8, v2.32.7, or v2.29.17 (depending on your release line). The fix adds a validation check that enforces a maximum file size limit (MaxFileSize = 100 MiB) before memory allocation. Alternatively, as a workaround, restrict access to the provisioner daemon serve endpoint to trusted provisioner daemon service accounts only.
GitHub Advisory DatabaseFix: Update to a patched version: v2.34.2 (for release line 2.34), v2.33.8 (for 2.33), v2.32.7 (for 2.32), or v2.29.17 (for 2.29 ESR). The fix validates HostnameSuffix and SSHConfigOptions against a strict character set that rejects newlines and other control characters. As a temporary workaround before updating, inspect the output of `coder config-ssh --dry-run` before applying changes.
GitHub Advisory DatabaseFix: Update to patched versions: v2.34.2, v2.33.8, v2.32.7, or v2.29.17 (depending on your release line). The fix prevents non-owner users from resetting passwords of accounts with the `owner` role. As a temporary workaround before upgrading, restrict the `user-admin` role to trusted administrators only.
GitHub Advisory DatabaseFix: Update to patched versions: v2.34.2, v2.33.8, v2.32.7, or v2.29.17 depending on your release line. The fix restricts email-based linking to first-time and legacy connections and defaults `email_verified` to false when the claim is missing or has an unexpected format. Alternatively, configure your OIDC provider to disallow self-registration or require email verification before issuing tokens.
GitHub Advisory DatabaseFix: Upgrade to one of the patched versions: v2.34.2 (for release line 2.34), v2.33.8 (for 2.33), v2.32.7 (for 2.32), or v2.29.17 (for 2.29 ESR). The fix properly handles the `email_verified` claim across boolean, string, and numeric types and blocks email-based account matching when the user already has a different linked identity provider. As a temporary workaround, ensure your identity provider returns `email_verified` as a native JSON boolean, though upgrading is still required to fully address the email-fallback linking issue.
GitHub Advisory Database