tocsin

Go/github.com/coder/coder/v2 CVE-2026-63443: unknown, EPSS 0.76%

Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write in github.com/coder/coder

Action: Upgrade github.com/coder/coder/v2 to 2.29.19 or later.

go get github.com/coder/coder/v2@v2.29.19
go get github.com/coder/coder/v2@v2.32.9
go get github.com/coder/coder/v2@v2.33.10
go get github.com/coder/coder/v2@v2.34.4

Affected

introducedfixedlast affected
2.27.02.29.19-
2.30.02.32.9-
2.33.02.33.10-
2.34.02.34.4-

Fixed versions

2.29.192.32.92.33.102.34.4

Sources

CVE-2026-63443 · published · modified · JSON