Attackers compromised Coder’s Cloudflare infrastructure on August 31, inserting unauthorized IP addresses into the pool of servers that handle requests to registry.coder.com — the package-hosting site developers use to source Terraform modules for workspace templates. From 07:35 to 21:45 UTC that day, Cloudflare routed some registry requests to the attackers’ servers instead of Coder’s legitimate infrastructure, delivering modified Terraform modules laced with credential-stealing code. The malicious modules searched compromised hosts for cloud credentials, API tokens, SSH keys, and other secrets, then exfiltrated the collected data to the lookalike domain coder-infra[.]com. The Coder platform is used by Dropbox, Palantir, Square, Mercedes-Benz, KKR, and U.S. government and defense organizations.
Coder says refresh tokens were not passed to the provisioner, and there is no evidence of impact to customer data the company itself maintains. However, because the attackers’ infrastructure is outside Coder’s control, the company cannot conclusively identify every compromised deployment. Coder has released patched versions (2.37.0, 2.36.4, 2.35.7, and 2.34.9) and urges all potentially affected users to rotate any credentials that were present on systems running workspace templates during the exposure window.
How to check if you’re affected
Affected products are Coder deployments running workspace templates that downloaded modules during the window of 07:35–21:45 UTC on August 31, 2026. To identify exposure, check your firewall, proxy, DNS, and VPC flow logs for any outbound connections to coder-infra[.]com. Also search provisioner logs for data.external.telemetry, identify which modules were downloaded during the window, and purge potentially malicious cached packages. Coder has published an SQL query to identify affected cached modules and template versions. Rotate all cloud credentials, API tokens, and SSH keys that were accessible from affected hosts.