An attacker broke into Coder’s Cloudflare infrastructure and added unauthorized servers to the pool behind its module registry. For 14 hours on August 31, some requests to the legitimate registry.coder.com domain received altered Terraform modules containing credential-stealing code, according to Coder’s critical security advisory.
The incident affects teams that use Coder to provision cloud development environments. A poisoned module could run where cloud, CI/CD, AI-tooling, database, OIDC, SSH, and external-auth credentials were available. Coder has published a specific exposure window, SQL checks, network and file indicators, cache-removal steps, patched releases, and credential-rotation guidance, but it did not quantify how many deployments received the malicious modules.
Registry servers carried malicious modules
Coder says the actor gained access to its Cloudflare account configuration and inserted unauthorized IP addresses into the registry server pool. Cloudflare then sent a subset of ordinary registry requests to infrastructure controlled by the attacker. Developers continued using the familiar Coder hostname; the routing layer behind it had changed.
The malicious servers returned altered Terraform module artifacts. Those modules included shell scripts and a Terraform external-data block that invoked dlp-docker.sh. Coder says the code searched for credentials and sent them to the lookalike domain coder-infra[.]com.
This was an active software-distribution compromise, rather than a hypothetical vulnerability. The advisory carries GHSA-vx42-ghc9-gw65, rates the incident critical at CVSS 9.0, and lists Coder versions below 2.37.0 as affected. Coder reports no known CVE.
Execution determined the secrets exposed
Coder describes two execution paths. A template upload, template update, or dry run executed the module in a provisioner without user secrets passed into that job. Even there, the malicious code could read environment variables, cloud and AI-tooling API keys, CI/CD credentials, configuration files, and terminal history available to the provisioner.
A workspace build added more valuable material. Coder says that path could expose the user’s OIDC token, a configured SSH key, and one-time tokens for external authentication providers used by the template. Refresh tokens were not passed to the provisioner.
Deployment architecture also changed the blast radius. When a provisioner ran inside coderd instead of as a separate service, Coder says the code likely had access to Coder configuration variables, including the database password and external-auth provider settings. A malicious artifact in cache establishes potential exposure; provisioner execution determines which secrets were actually reachable.
Coder reported “no indication that any customer data maintained by Coder was impacted.” That statement covers data held by the vendor. It does not clear credentials present inside customer-controlled provisioners that executed an altered module.
Figure details
The flow starts when an attacker adds an unauthorized server to the pool behind Coder's legitimate registry domain. A module request during the affected window reaches that server and receives an altered Terraform package. The package is cached or executed by a provisioner. Execution exposes environment variables and service credentials, with workspace-build and embedded-coderd deployments adding user tokens, SSH keys, external-auth tokens, and Coder configuration secrets. The module then sends collected data to attacker-controlled infrastructure.
Bound exposure to fourteen hours
The malicious artifacts were available from 07:35 UTC through 21:45 UTC on August 31. Coder says exposure primarily occurred when an operator created a new template, created a template version, or ran a template build dry run during that window. Workspace creation could also fetch a module when module caching was disabled; caching is enabled by default.
Start with Coder’s SQL queries. They identify cached module files created by the system user with MIME type application/x-tar during the affected interval, then join those files to template versions and workspaces. A third query searches provisioner job logs for the marker data.external.telemetry, including dry runs and builds that bypassed the normal cache path.
The SQL output is an exposure map, not proof that credentials left the environment. Coder explains the harder limit directly: “we do not have the ability to conclusively determine which users may have been affected.” The malicious server sat outside Coder’s control, so the company does not possess the complete server-side logs needed to identify every connection.
Hunt the published indicators
Review firewall, proxy, DNS, and VPC flow logs for outbound traffic to coder-infra[.]com and www[.]coder-infra[.]com. Coder associates that infrastructure with IP address 199[.]91[.]220[.]205 and the request path hxxp://www[.]coder-infra[.]com/cli/check. The advisory also lists the HTTP header signature X-CLI-Token: your-secret-token.
Search provisioner logs for data.external.telemetry and investigate the script names dlp-docker.sh and dlp.sh. Coder published these SHA-256 values:
7190a17c593276d7fd71c4863a4bc0b6c957ed14249288e6f64c5540e2c49398fordlp-docker.sha7f4fa5f7e33b2a6f6488cf28444584caa449144d246b083de919162f5514247for the commondlp.shvariant414d01f6072fbf05bef513e277f4c2b504a413c8e2aa5bae133a5cbc0cda9dc1for the Aider varianta64ce3038f2a501c9735abf6a1f9f04cbddbad53371cd68bec0f7510365c8ffafor the RStudio Server variantebbe0d2ed8cfaf9e19edb38ce44d6b407f9771b5c0813a7add27c05f66e89596for the Windows RDP variant7ef6b8c3c976fb60b3fa22e9e294ba548d9b532e060c1323a0124a3a7a647f13for the Zed variant
Keep download and execution evidence separate. A matching cache record or file hash proves that an artifact arrived. A provisioner log entry, process record, or outbound connection narrows which job ran it and which identities require urgent containment.
Purge modules and replace credentials
Coder directs operators to remove affected module files from the cache before a fresh deployment. Its advisory provides transactional SQL that clears references in template_version_terraform_values and deletes module files created during the incident window. Preserve the original database and job-log evidence before changing those records.
Upgrade after clearing the cache. Coder lists 2.37.0, 2.36.4, 2.35.7, and 2.34.9 as patched releases and says the currently served templates were reviewed and validated as free of the malicious code. The company also said it was preparing automatic remediation for a later release.
Rotate every credential that an affected provisioner could read: cloud keys, AI-tooling keys, CI/CD tokens, configuration secrets, OIDC tokens, SSH keys, one-time external-auth tokens, and, where the provisioner ran inside coderd, database and Coder configuration credentials. Revoke or replace active identities before rebuilding from a clean module cache.
Treat the 14-hour window as a credential-exposure boundary. Clean cache and patched software prevent another poisoned fetch from persisting. They cannot invalidate secrets that may already have left the environment. SQL results and execution telemetry decide scope; identity replacement decides recovery.