CVE-2026-121967

Encoded paths can bypass Coder’s upstream AI endpoint restrictions

Coder · Coder AI Gateway / AI Bridge

First documented disclosure · Review checkpoint

Summary

An authorized gateway user can reach provider endpoints outside the intended routes using the deployment’s provider credential.

Severity and exploitation evidence

Low · 2.3/10 · CVSS 4.0. Severity source.

Exploitation not established: The maintainer describes the routing behavior and the corrective change. No reviewed primary source identifies an exploited deployment.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The request could match an allowed route before path decoding or normalization removed traversal segments. The details differ across gateway versions.

Conditions required

AI Gateway is enabled and the user can access it. In 2.33.0 and later, the upstream or an intermediate proxy must normalize the decoded path.

Potential impact

Depending on the key’s permissions, the caller could read or change provider-side resources. The key material is not returned to the caller.

Affected versions and configurations

2.28.0–before 2.29.22, 2.30.0–before 2.34.13, 2.35.0–before 2.35.10, 2.36.0–before 2.36.8, 2.37.0–before 2.37.5 and 2.38.0–before 2.38.1.

Fix and mitigation status

The issue-specific fixes are 2.29.22, 2.34.13, 2.35.10, 2.36.8, 2.37.5 and 2.38.1. Coder says 2.28 and 2.30–2.33 will receive no patch on those lines.

Practical next steps

Move to a supported patched line. If upgrade must wait, disable the gateway or apply Coder’s precise encoded-path filtering rules at the edge.

Operating lesson

Apply the route allowlist to the same decoded path that the model provider actually resolves.

Evidence and limits

The September 30 patch proposal predates the October 21 advisory and November 4 CNA publication. Scope is limited to gateway passthrough and whatever the provider key authorizes.

Sources