How Coder’s Cloudflare routing was abused
Coder’s registry — registry.coder.com — sits behind Cloudflare and serves as the package-hosting site where developers pull components for workspace templates. According to Coder, the attacker gained access to the project’s Cloudflare infrastructure and added unauthorized servers to the registry’s pool. Because those IP addresses were accepted by Cloudflare’s routing, a subset of registry requests were directed to the attacker-controlled servers instead of Coder’s legitimate infrastructure.
The malicious servers hosted a lookalike implementation of Coder’s registry and served modified artifacts to users who requested modules during the exposure period. Coder says the delivery window ran from 07:35 UTC to 21:45 UTC on Monday, August 31.
What the malicious Terraform modules did
The artifacts delivered during the window were modified Terraform modules. Rather than simply provisioning infrastructure, the altered modules contained information-stealing code that searched infected hosts for a broad set of secrets and credentials. Coder listed the items the modules sought:
- Provisioner environment variables and secrets
- Cloud infrastructure and AI-tooling API keys
- CI/CD credentials
- Configuration-file secrets and terminal history
- User OIDC tokens
- Configured SSH keys
- One-time external authentication tokens
- Coder database passwords and other configuration secrets when the provisioner ran within ‘coderd’
Collected information was exfiltrated to the lookalike domain coder-infra[.]com.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleWho uses Coder and who may be exposed
Coder’s platform enables organizations to provide secure, self-hosted cloud development environments for building and deploying software, including AI applications. The project is used by prominent private and government organizations named by Coder: Dropbox, Palantir, Square, Mercedes‑Benz, KKR, EnBW, the U.S. government, and defense companies. Because these organizations — and others — source ready-made Terraform modules from the registry for workspace templates, those that fetched modules during the exposure window could have received the malicious artifacts.
Guidance Coder issued: detection and remediation
Coder’s advisory lays out immediate steps for potentially impacted users. The project recommends rotating all impacted secrets listed above as soon as possible. Before upgrading to a patched release, users running versions 2.37.0, 2.36.4, 2.35.7, or 2.34.9 should examine firewall, proxy, DNS, and VPC flow logs for connections to coder-infra[.]com.
Coder also advised developers to search provisioner logs for data.external.telemetry, identify modules downloaded during the exposure window, and purge potentially malicious cached packages. To help administrators, Coder shared an SQL query that can identify potentially affected cached modules and template versions.
Coder stated that refresh tokens were not passed to the provisioner and that it has found no evidence of impact to customer data it maintains. Still, the project cautioned that because the attacker’s infrastructure is outside Coder’s control, crucial logs are unavailable to the project and it cannot conclusively identify every compromised deployment.
What this means for developers, enterprise customers, and security teams
- Developers: Anyone who sourced Terraform modules from registry.coder.com during the window must assume modules could have been tampered with; immediate rotation of environment secrets, API keys, and SSH material is recommended by Coder.
- Enterprise and government customers: Organizations named as Coder users — and those similarly configured — should review provisioner and network logs for outbound connections to coder-infra[.]com and use the provided SQL query to find potentially affected cached modules and templates.
- Security teams: Teams should purge cached packages, inspect proxy/DNS/VPC logs, and treat any evidence of contact with the exfiltration domain as an indicator requiring secret rotation and additional forensics, because Coder cannot access attacker-side logs to complete the picture.
Implications for prevention and detection
Coder’s advisory underscores a recurring operational reality: when attackers gain the ability to serve legitimate-looking packages, they can use valid routing and credentials to bypass some preventative controls. The advisory notes that “overall prevention scores can hide what happens after initial access,” and cites the Blue Report 2026, which measures defenses technique by technique across 338 million simulations run in customer production environments. In short, prevention may look strong on paper while post-access actions remain effective for an attacker.
The immediate technical facts are clear: unauthorized IPs were added to a Cloudflare pool, malicious Terraform modules were served for roughly 14 hours on August 31, and exfiltration went to coder-infra[.]com. The outstanding operational fact is less prosaic but more consequential — because portions of the attacker’s infrastructure lie outside Coder’s visibility, no definitive accounting of every affected deployment is yet available. Administrators and security teams now hold the practical task Coder set out: search logs, rotate secrets, and purge caches, and then prove — with the artifacts and logs they control — that their environments are clean.