CVE-2026-126404 - Vulnerability Details

- Coder from 2.38.0 before 2.38.4 Privilege Escalation via API Key Creation

Description

Coder 2.28.0 before 2.29.24, 2.30.0 before 2.34.16, 2.35.0 before 2.36.11, 2.37.0 before 2.37.8, and 2.38.0 before 2.38.4 does not restrict new API keys to the creating token's scopes, allow list, or expiry. A scoped API key or OAuth2 token holding key-creation permission can call POST /api/v2/users/{user}/keys/tokens to mint longer-lived coder:all keys, gaining the user's full privileges.

Published: 2026-11-13

Score: 7.6 High

EPSS: < 1% Very Low

KEV: No

Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

coder

unaffected

Version	Status	Constraints
`2.38.0`	affected	< 2.38.4
`2.38.4`	unaffected	—

coder

unaffected

Version	Status	Constraints
`2.37.0`	affected	< 2.37.8
`2.37.8`	unaffected	—

coder

unaffected

Version	Status	Constraints
`2.36.0`	affected	< 2.36.11
`2.36.11`	unaffected	—

coder

unaffected

Version	Status	Constraints
`2.30.0`	affected	< 2.34.16
`2.34.16`	unaffected	—

coder

unaffected

Version	Status	Constraints
`2.28.0`	affected	< 2.29.24
`2.29.24`	unaffected	—

coder

unaffected

Version	Status	Constraints
`2.35.0`	affected	< 2.36.0
`2.36.0`	unaffected	—

No data.

Vendor Product Confidence Versions

Coder

95%

Version	Status	Scheme	Platform
`[2.38.0,2.38.4)`	affected	semver	—
`2.38.4`	unaffected	semver	—
`[2.37.0,2.37.8)`	affected	semver	—
`2.37.8`	unaffected	semver	—
`[2.36.0,2.36.11)`	affected	semver	—
`2.36.11`	unaffected	semver	—
`[2.30.0,2.34.16)`	affected	semver	—
`2.34.16`	unaffected	semver	—
`[2.28.0,2.29.24)`	affected	semver	—
`2.29.24`	unaffected	semver	—
`[2.35.0,2.36.0)`	affected	semver	—
`2.36.0`	unaffected	semver	—

Coder

100%

Version	Status	Scheme	Platform
`[2.37.0,2.37.8)`	affected	semver	—
`2.37.8`	unaffected	semver	—

Coder

100%

Version	Status	Scheme	Platform
`[2.36.0,2.36.11)`	affected	semver	—
`2.36.11`	unaffected	semver	—

Coder

100%

Version	Status	Scheme	Platform
`[2.30.0,2.34.16)`	affected	semver	—
`2.34.16`	unaffected	semver	—

Coder

100%

Version	Status	Scheme	Platform
`[2.28.0,2.29.24)`	affected	semver	—
`2.29.24`	unaffected	semver	—

Coder

100%

Version	Status	Scheme	Platform
`[2.35.0,2.36.0)`	affected	semver	—
`2.36.0`	unaffected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

Attack Vector Network

Attack Complexity High

Privileges Required Low

Attack Requirements Present

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00308.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://github.com/coder/coder/security/advisories/GHSA-x3gf-xv6p-56hf
https://www.vulncheck.com/advisories/coder-from-2.38.0-before-2.38.4-privilege-escalation-via-api-key-creation

History

Fri, 13 Nov 2026 09:45:00 +0000

Type	Values Removed	Values Added
Description		Coder 2.28.0 before 2.29.24, 2.30.0 before 2.34.16, 2.35.0 before 2.36.11, 2.37.0 before 2.37.8, and 2.38.0 before 2.38.4 does not restrict new API keys to the creating token's scopes, allow list, or expiry. A scoped API key or OAuth2 token holding key-creation permission can call POST /api/v2/users/{user}/keys/tokens to mint longer-lived coder:all keys, gaining the user's full privileges.
Title		Coder from 2.38.0 before 2.38.4 Privilege Escalation via API Key Creation
First Time appeared		Coder Coder coder
Weaknesses		CWE-266
CPEs		cpe:2.3:a:coder:coder::::::::
Vendors & Products		Coder Coder coder
References		https://github.com/coder/coder/security/advisories/GHSA-x3gf-xv6p-56hf https://www.vulncheck.com/advisories/coder-from-2.38.0-before-2.38.4-privilege-escalation-via-api-key-creation
Metrics		cvssV3_1 `{'score': 6.8, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N'}` cvssV4_0 `{'score': 7.6, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N'}`

Subscriptions

Coder Coder

MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published: 2026-11-13T09:35:45.631Z

Updated: 2026-11-13T20:26:01.693Z

Reserved: 2026-11-10T21:32:21.765Z

Link: CVE-2026-126404

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-11-13T10:17:45.087

Modified: 2026-11-13T10:17:45.087

Link: CVE-2026-126404

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-11-13T20:30:21Z

Weaknesses

CWE-266

Tracking

Attack Vector Network

Attack Complexity High

Privileges Required Low

Attack Requirements Present

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact None

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object