Coder registry compromised via Cloudflare to deliver malicious Terraform modules

Affected Systems

Coder registry infrastructure (registry.coder.com) accessed between 07:35 UTC and 21:45 UTC on August 31, 2026. All users who downloaded Terraform modules during this window are potentially affected. Patched versions: 2.37.0, 2.36.4, 2.35.7, and 2.34.9.

Exploitation Status

Active supply chain attack confirmed. Attackers compromised Cloudflare infrastructure to inject unauthorized registry servers delivering credential-stealing Terraform modules. Exfiltration to coder-infra[.]com observed during 14-hour window on August 31, 2026.

Business Impact

High-value targets affected including Dropbox, Palantir, Square, Mercedes-Benz, U.S. government, and defense contractors. Malicious modules stole provisioner secrets, cloud API keys, CI/CD credentials, SSH keys, OIDC tokens, database passwords, and terminal history. Credential compromise enables lateral movement and persistent access to cloud infrastructure and development pipelines. Coder cannot definitively identify all compromised deployments due to lack of access to attacker infrastructure logs.

Urgency

🔴 Immediate

Recommended Actions

• Immediately rotate all provisioner environment variables, cloud API keys, CI/CD credentials, SSH keys, OIDC tokens, and Coder database passwords if modules were downloaded from registry.coder.com between 07:35-21:45 UTC on August 31, 2026
• Search firewall, proxy, DNS, and VPC flow logs for connections to coder-infra[.]com to identify compromised systems
• Query provisioner logs for 'data.external.telemetry' and identify all modules downloaded during the exposure window; purge cached packages from affected systems
• Run Coder-provided SQL query against Coder database to identify potentially affected cached modules and template versions
• Upgrade to patched Coder versions: 2.37.0, 2.36.4, 2.35.7, or 2.34.9 depending on current release branch