Coder registry CDN origin pool compromise

Coder's advisory GHSA-vx42-ghc9-gw65. An attacker added unauthorized
origin IPs to the Cloudflare pool serving registry.coder.com. During
31 August 2026, 07:35–21:45 UTC, those origins returned modified
Terraform modules that stole provisioner secrets, cloud and AI API keys,
CI/CD credentials, OIDC tokens, SSH keys, and (when running inside
coderd) database passwords. Consumers still talked to the real CDN
hostname. Patched in 2.34.9–2.37.0.

Mapped techniques

T0209 Compromise package registry or CDN origin
T0205 Compromise third-party CDN or hosted web asset
T0121 Compromised legitimate artifact
T0140 Harvest tokens from environment variables
T0201 Customers compromised

supply-chain registry.coder.com origin pool

T0209 · Initial Access · Compromise package registry or CDN origin

Rogue origin IPs in the Cloudflare pool, not a stolen maintainer publish.

T0205 · Initial Access · Compromise third-party CDN or hosted web asset

The CDN hostname stayed trusted while origin membership changed.

T0121 · Resource Development · Compromised legitimate artifact

Real Terraform module names, malicious bytes.

T0140 · Credential Access · Harvest tokens from environment variables

Provisioner env, cloud/AI keys, CI creds, OIDC, SSH.

T0201 · Impact · Customers compromised

Anyone who pulled modules during the window ran the stealer.

Sources

https://github.com/coder/coder/security/advisories/GHSA-vx42-ghc9-gw65