Server-side Request Forgery (SSRF) Affecting github.com/coder/coder/v2/scaletest/agentconn package, versions >=2.27.0 <2.29.19>=2.30.0 <2.32.9>=2.33.0 <2.33.10>=2.34.0 <2.34.4
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applicationsSnyk Learn
Learn about Server-side Request Forgery (SSRF) vulnerabilities in an interactive lesson.
Start learning- Snyk IDSNYK-GOLANG-GITHUBCOMCODERCODERV2SCALETESTAGENTCONN-17872190
- published6 Jul 2026
- disclosed6 Jul 2026
- creditUnknown
Introduced: 6 Jul 2026
CVE NOT AVAILABLE CWE-863 Â (opens in a new tab)How to fix?
Upgrade github.com/coder/coder/v2/scaletest/agentconn to version 2.29.19, 2.32.9, 2.33.10, 2.34.4 or higher.
Overview
Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) via the agentConn.apiClient process. An attacker can gain unauthorized access to sensitive files or execute arbitrary commands as another workspace user by redirecting API requests to a victim's agent, provided the attacker controls a malicious workspace agent and knows the victim's agent UUID. This can result in cross-workspace and cross-tenant boundary compromise.