CVE-2026-121967
Full vulnerability record from the local CVENow database.
Description
Coder 2.28.0 before 2.29.22, 2.30.0 before 2.34.13, 2.35.0 before 2.35.10, 2.36.0 before 2.36.8, 2.37.0 before 2.37.5, and 2.38.0 before 2.38.1 contains a path traversal vulnerability in the AI Gateway passthrough router, which forwards percent-encoded dot segments upstream without rejecting them. Authenticated users can send paths such as %2e%2e or ..%2F under allowlisted prefixes to reach unintended provider endpoints using the deployment's centrally managed provider key.
Severity
LOW
CVSS score
2.3
(v4.0)
Vulnerability status
Received
Source identifier
Published
2026-11-04 16:17:50.360000
Last modified
2026-11-04 16:17:50.360000
View original CVE JSON
{
"id": "CVE-2026-121967",
"sourceIdentifier": "[email protected]",
"published": "2026-11-04T16:17:50.360",
"lastModified": "2026-11-04T16:17:50.360",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Coder 2.28.0 before 2.29.22, 2.30.0 before 2.34.13, 2.35.0 before 2.35.10, 2.36.0 before 2.36.8, 2.37.0 before 2.37.5, and 2.38.0 before 2.38.1 contains a path traversal vulnerability in the AI Gateway passthrough router, which forwards percent-encoded dot segments upstream without rejecting them. Authenticated users can send paths such as %2e%2e or ..%2F under allowlisted prefixes to reach unintended provider endpoints using the deployment's centrally managed provider key."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "coder",
"product": "coder",
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/coder/coder/v2",
"versions": [
{
"version": "2.37.0",
"lessThan": "2.37.5",
"versionType": "semver",
"status": "affected"
},
{
"version": "2.37.5",
"versionType": "semver",
"status": "unaffected"
}
]
},
{
"vendor": "coder",
"product": "coder",
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/coder/coder/v2",
"versions": [
{
"version": "2.36.0",
"lessThan": "2.36.8",
"versionType": "semver",
"status": "affected"
},
{
"version": "2.36.8",
"versionType": "semver",
"status": "unaffected"
}
]
},
{
"vendor": "coder",
"product": "coder",
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/coder/coder/v2",
"versions": [
{
"version": "2.35.0",
"lessThan": "2.35.10",
"versionType": "semver",
"status": "affected"
},
{
"version": "2.35.10",
"versionType": "semver",
"status": "unaffected"
}
]
},
{
"vendor": "coder",
"product": "coder",
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/coder/coder/v2",
"versions": [
{
"version": "2.30.0",
"lessThan": "2.34.13",
"versionType": "semver",
"status": "affected"
},
{
"version": "2.34.13",
"versionType": "semver",
"status": "unaffected"
}
]
},
{
"vendor": "coder",
"product": "coder",
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/coder/coder/v2",
"versions": [
{
"version": "2.28.0",
"lessThan": "2.29.22",
"versionType": "semver",
"status": "affected"
},
{
"version": "2.29.22",
"versionType": "semver",
"status": "unaffected"
}
]
},
{
"vendor": "coder",
"product": "coder",
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/coder/coder/v2",
"versions": [
{
"version": "2.38.0",
"lessThan": "2.38.1",
"versionType": "semver",
"status": "affected"
},
{
"version": "2.38.1",
"versionType": "semver",
"status": "unaffected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 2.3,
"baseSeverity": "LOW",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N",
"baseScore": 4.9,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 1.8,
"impactScore": 2.7
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-22"
}
]
}
],
"references": [
{
"url": "https://github.com/coder/coder/pull/30178",
"source": "[email protected]"
},
{
"url": "https://github.com/coder/coder/security/advisories/GHSA-373r-678h-hjc6",
"source": "[email protected]"
},
{
"url": "https://www.vulncheck.com/advisories/coder-before-2.29.22-2.34.13-2.35.10-2.36.8-2.37.5-and-2.38.1-ai-gateway-path-traversal",
"source": "[email protected]"
}
]
}