{"id":1384,"date":"2026-09-04T11:00:51","date_gmt":"2026-09-04T05:30:51","guid":{"rendered":"https:\/\/www.hexnode.com\/threat-watch\/?p=1384"},"modified":"2026-09-07T11:52:59","modified_gmt":"2026-09-07T06:22:59","slug":"coder-registry-compromise","status":"publish","type":"post","link":"https:\/\/www.hexnode.com\/threat-watch\/coder-registry-compromise\/","title":{"rendered":"Coder Registry Compromise Pushed Credential-Stealing Terraform Modules"},"content":{"rendered":"

A Coder registry compromise turned a trusted developer module source into a credential-theft channel on August 31, 2026. An unidentified attacker gained access to Coder\u2019s Cloudflare infrastructure and added unauthorized IP addresses to the server pool behind registry.coder.com<\/code>.<\/p>\n

Cloudflare consequently routed some legitimate registry requests to attacker-controlled servers. Those servers returned modified Coder registry artifacts containing malicious code. Coder says affected modules could collect cloud infrastructure credentials, AI-tooling API keys, CI\/CD credentials, OIDC tokens, SSH keys and other secrets available to provisioners.<\/p>\n

Coder published security advisory GHSA-vx42-ghc9-gw65, rated Critical with a CVSS v4.0 score of 9.0. GitHub lists Coder versions 2.37.0, 2.36.4, 2.35.7 and 2.34.9 as patched versions. It also instructs potentially affected users to identify and clear malicious cached modules before performing a fresh deployment and to update Coder.<\/p>\n

Coder registry compromise at a glance<\/h2>\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
Detail<\/span><\/b>\u00a0<\/span><\/td>\nInformation<\/span><\/b>\u00a0<\/span><\/td>\n<\/tr>\n
Advisory<\/span>\u00a0<\/span><\/td>\nGHSA-vx42-ghc9-gw65<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
Affected service<\/span>\u00a0<\/span><\/td>\nCoder module registry<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
Registry<\/span>\u00a0<\/span><\/td>\nregistry.coder.com<\/span>\u00a0<\/span><\/code><\/td>\n<\/tr>\n
Incident type<\/span>\u00a0<\/span><\/td>\nSoftware supply-chain compromise<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
Severity<\/span>\u00a0<\/span><\/td>\nCritical<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
CVSS<\/span>\u00a0<\/span><\/td>\n9.0, CVSS v4.0<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
CVE<\/span>\u00a0<\/span><\/td>\nNo known CVE<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
Exposure window<\/span>\u00a0<\/span><\/td>\nAugust 31, 2026, 07:35\u201321:45 UTC<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
Malicious domain<\/span>\u00a0<\/span><\/td>\ncoder-infra[.]com<\/span>\u00a0<\/span><\/code><\/td>\n<\/tr>\n
Malicious IP<\/span>\u00a0<\/span><\/td>\n199.91.220[.]205<\/span>\u00a0<\/span><\/code><\/td>\n<\/tr>\n
Patched versions<\/span>\u00a0<\/span><\/td>\n2.37.0, 2.36.4, 2.35.7, 2.34.9<\/span>\u00a0<\/span><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Coder says deployments may have been affected if they downloaded a Coder Registry module during the exposure window, primarily when creating new templates or template versions, or during workspace creation when module caching was disabled.<\/p>\n

How the Coder registry compromise created a malicious delivery path<\/h2>\n

Coder Registry provides reusable Terraform modules that teams can add to Coder workspace templates. The templates themselves define the underlying workspace infrastructure, which can include environments such as cloud virtual machines, containers or Kubernetes workloads.<\/p>\n

The attacker did not simply create a convincing fake registry domain.<\/p>\n

Instead, Coder says the unidentified actor accessed its Cloudflare infrastructure. The attacker then added unauthorized IP addresses to the pool serving Coder’s module registry.<\/p>\n

Those IP addresses hosted a modified version of the registry containing malicious artifacts. Cloudflare subsequently directed some requests for the legitimate registry.coder.com<\/code> service to those unauthorized servers.<\/p>\n

That distinction makes the attack particularly important.<\/p>\n

Users could request modules from the expected Coder registry hostname yet receive attacker-modified artifacts. If a deployment received an affected module, the malicious code could execute during template operations or a workspace build.<\/p>\n

Coder identified two primary execution scenarios<\/h3>\n

First<\/strong>, malicious modules could run when teams uploaded or updated templates or performed template dry runs. In this case, Coder says the primary exposure involved environment variables and secrets available on the provisioner.<\/p>\n

Second<\/strong>, the malicious modules could run during a workspace build, when the provisioner receives additional secrets including the user’s OIDC token, a configured SSH key and single-use tokens for configured external authentication providers. Coder says refresh tokens are not passed to the provisioner.<\/p>\n

If the provisioner ran as part of coderd<\/code> rather than as a separate service, Coder says this likely also leaked configuration variables such as the database password, external authentication provider information and other configuration.<\/p>\n

What the Coder registry compromise put at risk<\/h2>\n

The malicious Terraform modules functioned as credential-stealing software rather than conventional destructive malware.<\/p>\n

According to Coder, potentially accessible information included:<\/p>\n