CVE-2026-55432
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Summary
Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, the CreateSubAgent RPC did not validate a requested app sharing level against the template's MaxPortSharingLevel before persisting workspace apps, letting a workspace owner exceed the administrator's configured maximum. Exploitation requires the ability to register sub-agent apps in a workspace the attacker controls. The fix in versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2clamps the sub-agent app sharing level to the template's MaxPortSharingLevel. As a workaround, disable wildcard app hostnames (CODER_WILDCARD_ACCESS_URL) to block subdomain-based app routing.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| coder | coder | >= 2.34.0, < 2.34.2 | affected |
| coder | coder | >= 2.33.0, < 2.33.8 | affected |
| coder | coder | >= 2.30.0, < 2.32.7 | affected |
| coder | coder | < 2.29.17 | affected |
Weaknesses
- CWE-862: CWE-862: Missing Authorization
References
- https://github.com/coder/coder/security/advisories/GHSA-x9qq-2qh5-8rxf
- https://github.com/coder/coder/pull/26061
- https://github.com/coder/coder/releases/tag/v2.29.17
- https://github.com/coder/coder/releases/tag/v2.32.7
- https://github.com/coder/coder/releases/tag/v2.33.8
- https://github.com/coder/coder/releases/tag/v2.34.2
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.