CVE-2026-126404
- Source
- https://cve.org/CVERecord?id=CVE-2026-126404
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-126404.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-126404
- Aliases
-
- GHSA-x3gf-xv6p-56hf
- Published
- 2026-11-13T09:35:45Z
- Modified
- 2026-11-15T02:30:27Z
- Severity
-
- 7.6 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- Coder from 2.38.0 before 2.38.4 Privilege Escalation via API Key Creation
- Details
-
Coder 2.28.0 before 2.29.24, 2.30.0 before 2.34.16, 2.35.0 before 2.36.11, 2.37.0 before 2.37.8, and 2.38.0 before 2.38.4 does not restrict new API keys to the creating token's scopes, allow list, or expiry. A scoped API key or OAuth2 token holding key-creation permission can call POST /api/v2/users/{user}/keys/tokens to mint longer-lived coder:all keys, gaining the user's full privileges.
- Database specific
{ "cna_assigner": "VulnCheck", "cwe_ids": [ "CWE-266" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/126xxx/CVE-2026-126404.json" }- References
-
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/126xxx/CVE-2026-126404.json
- https://github.com/coder/coder/security/advisories/GHSA-x3gf-xv6p-56hf
- https://nvd.nist.gov/vuln/detail/CVE-2026-126404
- https://www.vulncheck.com/advisories/coder-from-2.38.0-before-2.38.4-privilege-escalation-via-api-key-creation
Affected packages
Git / github.com/coder/coder
Affected ranges
- Type
- GIT
- Repo
- https://github.com/coder/coder
- Events
-
IntroducedFixedIntroducedFixedIntroducedFixedIntroducedFixedIntroducedFixedIntroducedFixed
- Database specific
-
Show details
{ "extracted_events": [ { "range": [ { "introduced": "2.38.0" }, { "fixed": "2.38.4" } ], "source": "AFFECTED_FIELD", "strategy": "StandardRange" }, { "range": [ { "introduced": "2.37.0" }, { "fixed": "2.37.8" } ], "source": "AFFECTED_FIELD", "strategy": "StandardRange" }, { "range": [ { "introduced": "2.36.0" }, { "fixed": "2.36.11" } ], "source": "AFFECTED_FIELD", "strategy": "StandardRange" }, { "range": [ { "introduced": "2.30.0" }, { "fixed": "2.34.16" } ], "source": "AFFECTED_FIELD", "strategy": "StandardRange" }, { "range": [ { "introduced": "2.28.0" }, { "fixed": "2.29.24" } ], "source": "AFFECTED_FIELD", "strategy": "StandardRange" }, { "range": [ { "introduced": "2.35.0" }, { "fixed": "2.36.0" } ], "source": "AFFECTED_FIELD", "strategy": "StandardRange" } ] }