What happened
NVD REST verified (published 2026-10-17, CVSS 3.3 low, CWE-200). An unauthenticated local debug HTTP endpoint exposes the agent manifest including template-provided environment secrets to any same-workspace principal.
Why it matters
Coder is a popular self-hosted cloud-development/agent-workspace platform; AI development and agent runs are a primary use case. A lower-privileged workspace user escalating to read cloud keys and registry tokens via the agent's debug manifest breaks the trust boundary between co-tenants of an AI dev workspace.
Attack vector
A lower-privileged user or process in the same workspace queries the unauthenticated localhost:2113 /debug/manifest endpoint of the Coder agent to read environment variable values (credentials) that the template injected into the workspace.
Affected systems
Coder (github.com/coder/coder) 2.10.0 through < 2.34.8
Mitigation
Upgrade to Coder 2.34.8 (GitHub advisory GHSA-73wg-wxvv-9r4j; VulnCheck advisory). Restrict who can co-inhabit a workspace until patched.