coder github.com/coder/agentapi vulnerabilities

Latest coder github.com/coder/agentapi CVEs

Newest publication first

1. CVE-2025-59956 Coder AgentAPI exposed user chat history via a DNS rebinding attack

   Published 2025-10-23

   Medium·CVSS 6.5

   Summary AgentAPI prior to version 0.4.0 was susceptible to a client-side DNS rebinding attack when hosted over plain HTTP on localhost. Impact An attacker could have gained access to the /messages endpoint served by the Agent API. This allowed for the unauthorized exfiltration of...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.