Coder: Workspace agent API insecure redirect handling allowed cross-agent file read and write

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-63443 · Microsoft / collected KEV context

EUVD-2026-78927

GHSA-qrwj-vh9x-gw5v

GO-2026-5923

cve-program · CVE-2026-63443

• https://github.com/coder/coder/security/advisories/GHSA-qrwj-vh9x-gw5v
• https://github.com/coder/coder/pull/26600
• https://github.com/coder/coder/pull/26611
• https://github.com/coder/coder/pull/26612
• https://github.com/coder/coder/pull/26613
• https://github.com/coder/coder/pull/26622
• https://github.com/coder/coder/commit/2312b67bc52c4e314c18c4b4be5dcf5500c94ad7
• https://github.com/coder/coder/commit/812549d671d0f5a0b45adcee860d37b70aaddccd
• https://github.com/coder/coder/commit/ec3ba84c0002f47dd979c073cde1ab345acbaea5
• https://github.com/coder/coder/commit/eeb2624549ddb85538e493af3e678fdb185a809f
• https://github.com/coder/coder/commit/f8bdec5add4711650d5bfb6ff93d0cc9d7821c81
• https://github.com/coder/coder/releases/tag/v2.29.19
• https://github.com/coder/coder/releases/tag/v2.32.9
• https://github.com/coder/coder/releases/tag/v2.33.10
• https://github.com/coder/coder/releases/tag/v2.34.4

euvd · EUVD-2026-78927

• https://github.com/coder/coder/security/advisories/GHSA-qrwj-vh9x-gw5v
• https://github.com/coder/coder/pull/26600
• https://github.com/coder/coder/pull/26611
• https://github.com/coder/coder/pull/26612
• https://github.com/coder/coder/pull/26613
• https://github.com/coder/coder/pull/26622
• https://github.com/coder/coder/commit/2312b67bc52c4e314c18c4b4be5dcf5500c94ad7
• https://github.com/coder/coder/commit/812549d671d0f5a0b45adcee860d37b70aaddccd
• https://github.com/coder/coder/commit/ec3ba84c0002f47dd979c073cde1ab345acbaea5
• https://github.com/coder/coder/commit/eeb2624549ddb85538e493af3e678fdb185a809f
• https://github.com/coder/coder/commit/f8bdec5add4711650d5bfb6ff93d0cc9d7821c81
• https://github.com/coder/coder/releases/tag/v2.29.19
• https://github.com/coder/coder/releases/tag/v2.32.9
• https://github.com/coder/coder/releases/tag/v2.33.10
• https://github.com/coder/coder/releases/tag/v2.34.4

nvd · CVE-2026-63443

• https://github.com/coder/coder/commit/2312b67bc52c4e314c18c4b4be5dcf5500c94ad7
• https://github.com/coder/coder/commit/812549d671d0f5a0b45adcee860d37b70aaddccd
• https://github.com/coder/coder/commit/ec3ba84c0002f47dd979c073cde1ab345acbaea5
• https://github.com/coder/coder/commit/eeb2624549ddb85538e493af3e678fdb185a809f
• https://github.com/coder/coder/commit/f8bdec5add4711650d5bfb6ff93d0cc9d7821c81
• https://github.com/coder/coder/pull/26600
• https://github.com/coder/coder/pull/26611
• https://github.com/coder/coder/pull/26612
• https://github.com/coder/coder/pull/26613
• https://github.com/coder/coder/pull/26622
• https://github.com/coder/coder/releases/tag/v2.29.19
• https://github.com/coder/coder/releases/tag/v2.32.9
• https://github.com/coder/coder/releases/tag/v2.33.10
• https://github.com/coder/coder/releases/tag/v2.34.4
• https://github.com/coder/coder/security/advisories/GHSA-qrwj-vh9x-gw5v

osv · GHSA-qrwj-vh9x-gw5v

• https://github.com/coder/coder/security/advisories/GHSA-qrwj-vh9x-gw5v
• https://github.com/coder/coder/pull/26600
• https://github.com/coder/coder

osv · GO-2026-5923

• https://github.com/coder/coder/security/advisories/GHSA-qrwj-vh9x-gw5v
• https://github.com/coder/coder/pull/26600

No related operational record is retained in the current change model.