Critical Flaw in HashiCorp Terraform Registry Lets Attackers Steal Cloud Credentials

Key Takeaways

• A critical security incident at Coder resulted in the unauthorized distribution of malicious Terraform modules from its registry.
• Attackers compromised Coder’s Cloudflare infrastructure to redirect registry traffic to malicious servers.
• The malicious packages, active on August 31, 2026, from 07:35 UTC to 21:45 UTC, aimed to steal cloud credentials from development environments.
• The vulnerability primarily affected users creating or updating Coder workspace templates and deploying workspaces with disabled Terraform module caching.
• Patched versions 2.37.0, 2.36.4, 2.35.7, and 2.34.9 have been released, and users are advised to update and rotate compromised credentials.

Critical Flaw in HashiCorp Terraform Registry Lets Attackers Steal Cloud Credentials

A significant security breach at Coder exposed users of its Terraform module registry to malicious software designed to pilfer credentials from cloud development setups. The incident centered on unauthorized alterations to Coder’s Cloudflare infrastructure, which allowed an unknown threat actor to divert specific registry traffic to servers under their control.

The attack involved the insertion of unauthorized IP addresses into the infrastructure pool utilized by the Coder module registry, as detailed in Coder’s security advisory. These rogue servers hosted a compromised registry that contained modified Terraform artifacts embedded with code engineered for credential theft.

The primary service impacted was Coder’s main registry, registry.coder.com, a common source for workspace templates and modules. The malicious packages were actively distributed for a limited window, specifically between 07:35 UTC and 21:45 UTC on August 31, 2026.

Organizations faced potential exposure if they performed actions such as creating a new Coder workspace template, updating an existing template version, running a template dry run, or deploying a workspace during the compromise period, particularly if Terraform module caching was not enabled.

Attackers Hijack Coder Registry

The injected malicious code specifically targeted secrets accessible within the Terraform provisioner environment. Coder reported that the malware attempted to identify and exfiltrate credentials to an external server using a deceptive domain, coder-infra[.]com.

This lookalike domain was crafted to mimic legitimate Coder infrastructure, making it more challenging to detect malicious outbound connections during routine log reviews. The compromised Terraform modules reportedly leveraged a data.external.telemetry block to execute a script named dlp-docker.sh.

This script established communication with the attacker-controlled endpoint at www[.]coder-infra[.]com/cli/check, transmitting data via an X-CLI-Token HTTP header. The associated IP address identified in the advisory was 199.91.220[.]205.

The extent of the impact varied depending on how the malicious module was executed. During template imports, updates, and dry runs, the primary risk involved the exposure of environment variables and secrets residing on the provisioner host.

In the context of a workspace build, the malicious code could also gain access to temporary user secrets passed to the provisioner. This could include a user OIDC token, an SSH key if configured, and various one-time external authentication tokens.

Organizations operating the provisioner within the core Coder service faced a potentially broader exposure. In such deployment scenarios, the malware could have accessed sensitive Coder configuration values, including database credentials, external authentication provider settings, and other application-specific secrets.

Coder stated in its GitHub advisory GHSA-vx42-ghc9-gw65 that there was no evidence indicating that customer data maintained directly by the company was compromised.

What You Should Do

• Coder has released patched versions 2.37.0, 2.36.4, 2.35.7, and 2.34.9. Users running earlier versions must update immediately.
• Remove any potentially malicious registry modules from your cache that were downloaded during the exposure period (August 31, 2026, 07:35 UTC to 21:45 UTC).
• Review Coder deployment records for module downloads within the affected timeframe.
• Search DNS, firewall, proxy, and VPC flow logs for any connections to the domain coder-infra[.]com or the IP address 199.91.220[.]205.
• Inspect provisioner logs for the string data.external.telemetry, which indicates the execution of the malicious Terraform block.
• Rotate all credentials that could have been accessible to the Coder deployment. This includes cloud API keys, CI/CD secrets, AI tooling tokens, SSH keys, OIDC tokens, and any credentials stored in environment variables or terminal history.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.