What’s Vulnerable › Vulnerabilities

CVE-2026-111929: Coder 2.30.0 before 2.34.8 Cross-Organization File Disclosure via DownloadFile RPC

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-17 · updated 2026-10-19
• Weakness: CWE-863

Description

Coder from 2.30.0 before 2.34.8 contains an authorization bypass vulnerability in the provisioner daemon DownloadFile gRPC handler that allows authenticated provisioner daemons to download other organizations' cached Terraform module archives. Attackers with an org-scoped provisioner key and a known file UUID can retrieve module source code exposing infrastructure topology or embedded secrets.

Affected products

• coder: from 2.30.0 before 2.34.8 — fixed in 2.34.8

How to fix

Upgrade to a fixed version: coder 2.34.8. Check the vendor advisory for mitigations.

References

• https://github.com/coder/coder/security/advisories/GHSA-hrhj-hpwc-9hmc
• https://www.vulncheck.com/advisories/coder-2.30.0-before-2.34.8-cross-organization-file-disclosure-via-downloadfile-rpc

Get alerted when CVE-2026-111929 or the next vulnerability affects your stack