CVE-2026-63443

Executive Summary

CVE-2026-63443 is an authorization/redirect-handling flaw in Coder, a platform that provisions remote development environments via Terraform. In versions prior to 2.29.19, 2.32.9, 2.33.10, and 2.34.4, agentConn.apiClient() follows HTTP redirects and its custom transport accepts the host from the redirected request URL when the destination port matches the workspace agent HTTP API port (port 4). An authenticated user who controls a modified workspace agent and knows another online agent's UUID can derive the victim's tailnet address and redirect control-plane requests to that agent. Impact is high: redirected workspace agent file APIs can read or write files as the victim workspace user, and where the process API is exposed, commands can be executed after a redirected file write — crossing workspace and tenant boundaries. CVSS 3.1 base score is 8.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L).

Technical Analysis

Coder's architecture links a control plane with distributed workspace agents. The affected component, agentConn.apiClient(), is the client used by the control plane (or its components) to make HTTP requests to a workspace agent's HTTP API. The vulnerability is a combination of two defects:

1. Redirect-following behavior. agentConn.apiClient() follows HTTP redirects sent by the remote endpoint. An attacker who controls a modified workspace agent can therefore cause the client to fetch a URL of the attacker's choosing.

2. Host acceptance from redirect URL on a specific port. The custom transport used by agentConn.apiClient() normally pins or constrains the destination host. However, when the port in the redirected URL equals the workspace agent HTTP API port — described in the advisory as port 4 — the transport accepts the host from the redirected request URL rather than enforcing the originally intended host. This defeats the intended host restriction and allows the client to be steered to a different agent.

The advisory states that an authenticated user with a modified workspace agent, who also knows another online agent's UUID, can derive the victim's tailnet address and redirect control-plane requests to that victim agent. This means the attacker does not need network reachability to the victim's tailnet address up front; knowledge of the UUID plus the redirect flaw is sufficient to compute/derive the target address and cause the control plane to initiate a request toward it.

Redirect semantics and request class impact. The advisory explicitly distinguishes redirect types:

• HTTP 301, 302, 303 — these convert the request to a GET and are used here to redirect read requests.
• HTTP 307, 308 — these preserve the original HTTP method and body, allowing replayable write and process-start requests to be redirected intact.

Consequences at the victim agent. Because the redirected request is authenticated as (or proxied on behalf of) the victim's workspace context, the victim workspace agent's file APIs can be induced to read or write files as the victim workspace user. Furthermore, in affected versions that expose the workspace agent process API, an attacker can execute commands after a redirected file write — i.e., write a payload via a redirected file-write request, then trigger execution via the process API. This crosses workspace and tenant boundaries, elevating a single authenticated workspace user to control over another user's workspace and tenant resources.

Root cause is mapped to CWE-863 (Incorrect Authorization) — the transport fails to enforce the intended host/authorization boundary when port 4 is present in the redirect target.

Unspecified details. The NVD description does not disclose the exact redirect-validation code, header names, or specific file/process API endpoint paths; those are not fabricated here. No public PoC, Nuclei template, or exploit code is available as of this report.

Exploitation Scenarios

No public PoC is available; the following chain is inferred from the advisory's description of the flaw class and stated preconditions (authenticated attacker, modified agent, knowledge of victim agent UUID). All named functions/behaviors below appear verbatim in the advisory.

Preconditions:

• Attacker holds an authenticated account with the ability to run a modified workspace agent.
• Attacker knows the UUID of another user's online workspace agent.
• Victim runs an affected Coder version (prior to 2.29.19/2.32.9/2.33.10/2.34.4).

Step 1 — Reconnaissance / target identification. The attacker enumerates or otherwise obtains a target workspace agent's UUID. The advisory states the attacker must "know another online agent's UUID," implying UUIDs are discoverable or guessable within the attacker's reachable scope.

Step 2 — Trigger the flawed redirect. Using a modified agent under their control, the attacker responds to requests made by agentConn.apiClient() with an HTTP redirect (301/302/303 for reads; 307/308 for writes/process-start) whose target host is derived from the victim's tailnet address and whose port is the workspace agent HTTP API port 4. Because the custom transport accepts the host from the redirected URL when port 4 is used, the control-plane client is steered to the victim's agent instead of being blocked.

Step 3 — Execution at the vulnerability-class level. The redirected, still-authenticated requests reach the victim workspace agent's file APIs:

• Read requests (via 301/302/303) cause the victim agent to read files as the victim workspace user.
• Write requests (via 307/308) cause the victim agent to write files as the victim workspace user.
• Where the workspace agent process API is exposed, the attacker issues a redirected file write and then a process-start request to execute commands in the victim's workspace.

Step 4 — Post-exploitation impact. Attacker gains cross-workspace and cross-tenant read/write and (where process API is exposed) command execution as the victim workspace user. This enables data theft, source-code tampering, injection of build artifacts or secrets, lateral movement within the victim tenant, and potential supply-chain exposure if victim workspaces feed downstream pipelines.

Impact Assessment

• Confidentiality (C:H). File APIs can read files as the victim workspace user, exposing source code, credentials, and secrets.
• Integrity (I:H). File APIs can write files as the victim workspace user; combined with process API exposure, attackers can execute commands, enabling persistent code tampering and pipeline poisoning.
• Availability (A:L). Limited direct availability impact; some risk from destructive writes or process execution.
• Scope (S:U). CVSS scopes unchanged, but the advisory emphasizes crossing workspace and tenant boundaries — a significant logical blast-radius expansion within a single deployment.
• Attack vector (AV:N/AC:L/PR:L/UI:N). Network-reachable, low complexity, requires low privileges (authenticated account with modified agent), no user interaction.

Blast radius. Any multi-tenant Coder deployment with online workspace agents and exposed workspace agent file/process APIs is in scope. A single low-privileged authenticated tenant can target other tenants' workspaces. Business consequences include intellectual-property theft, tampering with developer tooling supply chains, and lateral movement into environments provisioned for CI/CD. EPSS is not yet scored by FIRST.org; no CISA KEV listing.

Detection Guidance

Sigma Rule

title: Coder Agent Redirect to Workspace Agent API Port 4
id: 8f2b1c74-9d3a-4e21-b8c5-coder63443a
status: experimental
description: Detects Coder control-plane requests to workspace agent HTTP API on port 4 following an HTTP redirect from a workspace agent, indicative of CVE-2026-63443.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-63443
author: valtersit.com
date: 2026/01/01
logsource:
  product: coder
  service: access
detection:
  selection_port:
    dst_port: 4
  selection_redirect:
    http_status|in:
      - 301
      - 302
      - 303
      - 307
      - 308
  selection_endpoint:
    url|contains:
      - "/api/v2/workspaceagents/"
      - "agent"
  condition: selection_endpoint and (selection_port or selection_redirect)
falsepositives:
  - Legitimate internal agent health checks on port 4
level: high

YARA Rule

rule CVE_2026_63443_Coder_Agent_Redirect
{
    meta:
        author = "valtersit.com"
        description = "Detects references to agentConn.apiClient redirect handling and workspace agent API port 4 indicative of CVE-2026-63443 exploitation or vulnerable code."
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-63443"
        date = "2026-01-01"
    strings:
        $s1 = "agentConn.apiClient" ascii
        $s2 = "workspace agent HTTP API" ascii nocase
        $s3 = "tailnet" ascii nocase
        $s4 = "workspaceagents" ascii nocase
    condition:
        uint16(0) == 0x5A4D or any of them
}

Suricata IDS Rule

alert http any any -> any 4 (msg:"CVE-2026-63443 Coder workspace agent redirect to port 4"; flow:established,to_server; http.response_status_code:301; http.location; content:"/"; pcre:"/workspaceagent/i"; sid:63443001; rev:1;)
alert http any any -> any 4 (msg:"CVE-2026-63443 Coder workspace agent redirect via 307/308"; flow:established,to_server; http.response_status_code:307; http.location; sid:63443002; rev:1;)

Elastic Detection

network where destination.port == 4 and
  process.name in ("coder", "coder-server", "agent") and
  network.transport == "tcp"

Splunk SPL Query

index=coder sourcetype=coder:access OR sourcetype=coder:agent
| search (status=301 OR status=302 OR status=303 OR status=307 OR status=308) dst_port=4
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, dest_host, url, status
| where count > 0
| sort -count

Wazuh OSSEC Rule

<group name="coder,cve-2026-63443,">
  <rule id="634430" level="10">
    <decoded_as>json</decoded_as>
    <field name="dst_port">^4$</field>
    <regex field="http_status">^(301|302|303|307|308)$</regex>
    <description>CVE-2026-63443: Coder workspace agent redirected request to API port 4 - potential cross-tenant exploitation</description>
    <mitre>
      <id>T1213</id>
    </mitre>
    <group>cve_2026_63443,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED — single source claims patch (not independently confirmed)). Confirm vendor advisories before relying solely on these versions.

1. Immediate mitigations.

   • Upgrade to any fixed release: 2.29.19, 2.32.9, 2.33.10, or 2.34.4 (or later).
   • If upgrade cannot be immediate, restrict/disable exposure of the workspace agent process API for untrusted tenants and review which tenants can run modified workspace agents.
   • Reduce the pool of users permitted to register or run custom/modified workspace agents; audit agent registration for anomalies.
   • Treat workspace agent UUIDs as sensitive; limit discovery of other tenants' agent UUIDs.

2. Patch/upgrade steps.

   • Identify all Coder server and agent versions; ensure any version below the fixed releases is upgraded.
   • Roll the upgrade across control plane and agents in a coordinated window.
   • Validate post-upgrade that agentConn.apiClient() no longer accepts hosts from redirected URLs on port 4.

3. Long-term hardening.

   • Enforce host pinning in transport layers — never trust a host from a redirect target; validate against an allow-list.
   • Apply strict redirect policies (limit or disable cross-host redirects for control-plane-to-agent communication).
   • Deploy network egress controls and monitor east-west traffic to agent API port 4.
   • Maintain monitoring for redirect chains originating from agents and alert on cross-tenant access patterns.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-63443
• Coder (vendor) — project/advisory channel: https://coder.com
• OSV entry (patch source): https://osv.dev
• CWE-863 Incorrect Authorization: https://cwe.mitre.org/data/definitions/863.html
• FIRST EPSS (not yet scored): https://www.first.org/epss

Threat actor campaigns: none identified; no exploit-in-the-wild evidence; not listed in CISA KEV as of this report.