Coder users received a major wake-up call on August 31, 2026, when its Terraform module registry—used by developers to load workspace templates and shared modules—was compromised by attackers intent on stealing cloud credentials. The breach stemmed from unauthorized modifications in Coder’s Cloudflare setup, which allowed malicious actors to redirect traffic to impostor servers hosting malicious modules. These modules were designed to extract sensitive data from victim environments.
At around 07:35 UTC on that day, the exploit began. Unauthorized IPs were inserted into the infrastructure pool for registry.coder.com, enabling attackers to deliver altered Terraform artifacts during the period when Terraform module caching was disabled—making each request vulnerable. The exposure lasted until approximately 21:45 UTC. Any Terraform operations around setup of new workspace templates, version updates, or template dry runs were at risk.
How the Attack Worked
The injected malicious code aimed specifically at credentials present in the Terraform provisioner environment. It made use of a lookalike domain—coder-infra[.]com—to mask exfiltration of data. A script named dlp-docker.sh, executed through a Terraform data.external.telemetryblock, sent content to www[.]coder-infra[.]com/cli/check, using an X-CLI-TokenHTTP header. An identified IP, 199.91.220[.]205, was associated with these interactions.
What Could Be Exposed
The level of risk varied depending on how a user interacted with the compromised modules. For template imports, updates, or dry runs, environment variables and secrets accessible to the Terraform provisioner could have leaked. In full workspace builds, temporary secrets—such as one-time authentication tokens, SSH keys (if configured), or OpenID Connect (OIDC) credentials—might also have been exposed. Meanwhile, deployments of Coder’s primary service may have revealed even more critical assets: database credentials, external authentication configurations, and internal application secrets.
Despite the severity, there was no evidence that customer data stored by Coder was altered or exfiltrated in bulk. The attacker’s reach was limited to the modules and templates running during the compromised period.
What Users Must Do Now
Coder pushed urgent patch updates—versions 2.37.0, 2.36.4, 2.35.7, and 2.34.9—to close the vulnerability. Users operating earlier versions are strongly urged to update, clear their module caches, and remove any modules fetched during the incident window.
Security teams should scour deployment logs for module downloads between 07:35 and 21:45 UTC on August 31. They should also examine DNS, firewall, proxy, and virtual private cloud (VPC) flow logs for traffic to coder-infra[.]com, and search provisioner logs for the telemetry block data.external.telemetry. Finally, any exposed credentials—cloud API keys, CI/CD secrets, SSH keys, OIDC tokens—must be rotated immediately.
This incident underscores a critical, often-overlooked risk in infrastructure-as-code workflows: even trusted registries can expose users when the underlying package-delivery or traffic-routing infrastructure is compromised. The breach serves as a warning to all teams relying heavily on IaC tools like Terraform.
Why It Matters:As organizations lean more on automation and shared module libraries, supply-chain attacks against fundamental infrastructure tools can cause widespread exposure. Vigilant patching, tight access controls, and robust auditing practices are essential. Going forward, users should monitor their IaC toolchains closely, ensure module provenance, and ideally enforce module caching and integrity checks—even when using widely trusted registries.
