What happened
The AI Gateway passthrough router does not reject percent-encoded traversal segments, allowing an authenticated user to escape the allowlisted prefix and reach arbitrary provider endpoints. Because the gateway authenticates with the centrally managed provider key, the request consumes/queries on behalf of the deployment's shared AI credential.
Why it matters
Coder exposes an AI Gateway that brokers access to LLM providers for workspace users using a single shared provider key. A traversal here lets an authenticated user access provider endpoints outside the allowed AI surface, risking cost/usage abuse, cross-tenant access to provider-scoped resources, or triggering unintended model operations under the enterprise's key.
Attack vector
An authenticated user sends percent-encoded dot segments (e.g. %2e%2e, ..%2F) under an allowlisted prefix through the AI Gateway passthrough router. Coder forwards them upstream without rejecting, so the request reaches unintended provider endpoints using the deployment's centrally managed provider API key.
Affected systems
Coder 2.28.0 < 2.29.22; 2.30.0 < 2.34.13; 2.35.0 < 2.35.10; 2.36.0 < 2.36.8; 2.37.0 < 2.37.5; 2.38.0 < 2.38.1
Mitigation
Upgrade to the patched Coder release for your line (>=2.29.22, >=2.34.13, >=2.35.10, >=2.36.8, >=2.37.5, or >=2.38.1); see GHSA-373r-678h-hjc6 and PR #30178.