CVE-2023-26114

code-server vulnerable to Missing Origin Validation in WebSockets

8.2 HighFix available

Versions of the package code-server before 4.10.1 are vulnerable to Missing Origin Validation in WebSockets handshakes. Exploiting this vulnerability can allow an adversary in specific scenarios to access data from and connect to the code-server instance.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: High
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: Low

Exploit likelihood

0.34%Up 0.3 points since Mar 23, 2023

What each source reports

CVE List Score used 8.2

Record: CVE-2023-26114
CVSS 3.1: 8.2 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:L/E:P
CVSS 3.1: 9.3 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Weakness: CWE-1385, CWE-346
Updated: 2026-11-02

EUVDEUVD-2023-1003 8.2

Record: EUVD-2023-1003
CVSS 3.1: 8.2 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:L/E:P
Updated: 2026-11-02

GitHub AdvisoriesGHSA-frjg-g767-7363 9.3

code-server vulnerable to Missing Origin Validation in WebSockets

Record: GHSA-frjg-g767-7363
CVSS 3.1: 9.3 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Weakness: CWE-346, CWE-1385
Updated: 2026-11-02

NVD 8.2

Record: CVE-2023-26114
CVSS 3.1: 8.2 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:L
CVSS 3.1: 9.3 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
CVSS 3.1: 9.3 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Weakness: CWE-1385, CWE-346
Updated: 2026-11-02

OSV 8.2

Record: CVE-2023-26114
CVSS 3.1: 8.2 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:L/E:P
Weakness: CWE-1385
Updated: 2026-11-02

OSVGHSA-frjg-g767-7363 9.3

code-server vulnerable to Missing Origin Validation in WebSockets

Record: GHSA-frjg-g767-7363
CVSS 3.1: 9.3 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Weakness: CWE-1385, CWE-346
Updated: 2026-11-02

Affected products

coder code-server

Affected packages

Affected packages
Package	Affected	Fixed
`code-server` npm	before 4.10.1	4.10.1

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-26114 is a high vulnerability (CVSS 8.2) in Coder Code-server, published March 23, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.34%, the 27th percentile. Fixed in code-server 4.10.1.