Coder discloses Cloudflare breach that delivered malicious Terraform modules

September 5, 2026 at 01:38 AM1 min

This digest was compiled by AI from multiple sources — links to the originals are below.

Coder disclosed that attackers compromised its Cloudflare infrastructure on August 31, injecting unauthorized registry servers that served malicious Terraform modules to a subset of users. The modules stole provisioner environment variables, cloud API keys, CI/CD credentials, configuration secrets, and SSH keys, exfiltrating them to coder-infra[.]com. Coder has released patched versions but cannot identify all compromised deployments.

Key Facts

The attack occurred between 07:35 UTC and 21:45 UTC on Monday, August 31.
Attackers inserted unauthorized IP addresses into the module registry's server pool within Coder's Cloudflare infrastructure.
Stolen data was exfiltrated to the domain coder-infra[.]com.
Coder recommends affected users rotate all potentially compromised secrets and examine network logs for connections to the malicious domain.

Attack Details

Attackers gained access to Coder's Cloudflare infrastructure and inserted unauthorized IP addresses into the module registry's server pool. This redirection caused a subset of users to receive malicious Terraform modules instead of legitimate ones. The compromised modules were designed to steal sensitive information, including provisioner environment variables, cloud infrastructure API keys, CI/CD credentials, configuration secrets, and SSH keys. The stolen data was exfiltrated to the domain coder-infra[.]com.

Response and Mitigation

Coder has released patched versions of its software. Coder recommends that affected users rotate all potentially compromised secrets and examine network logs for connections to the malicious domain. Coder cannot definitively identify all compromised deployments due to the attacker's infrastructure being outside its control.