https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-11-14T08:00:03.387338+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cve-2026-126308 CVE-2026-126308 — Coder 2.38.0 before 2.38.2 Session Token Leak via Sub-Agent External Apps 2026-11-14T08:00:03.388838+00:00

Affected: coder

The web dashboard in Coder 2.24.0 before 2.29.23, 2.30.0 before 2.34.14, 2.35.0 before 2.36.9, 2.37.0 before 2.37.6, and 2.38.0 before 2.38.2 replaces the $SESSION_TOKEN placeholder in external app URLs with a full-access API key without checking whether the app belongs to a sub-agent. Code running in a workspace can register a disguised sub-agent app with a custom protocol URL, so the owner's click sends their API key to an attacker-chosen destination.