Executive brief
Coder is a platform used by organizations to manage remote development environments. A security flaw in how the system handles internal networking allows a malicious agent to impersonate other development workspaces. This could enable an attacker to intercept private data or sessions intended for a different user's workspace.
Technical details
An improper authorization vulnerability exists in Coder's tailnet coordinator. While the coordinator validates that an agent's 'Addresses' derive from its authenticated UUID, it fails to apply the same check to 'AllowedIPs'. These values are forwarded verbatim to tunnel peers and installed into WireGuard configurations. A malicious agent can advertise a victim agent's IP prefix, causing the server to route traffic intended for the victim to the attacker instead. This allows for session interception between workspaces. The issue is fixed by applying UUID-derivation validation to the 'AllowedIPs' field in both the in-memory and Postgres coordinators.
Affected products
- Coder Coder < 2.29.17, >= 2.30.0 < 2.32.7, >= 2.33.0 < 2.33.8, >= 2.34.0 < 2.34.2
Timeline
- 2026-06-11: patched: Fix merged into main branch
- 2026-07-08: disclosed: NVD publication date
References
- https://github.com/coder/coder/pull/26144
- https://github.com/coder/coder/releases/tag/v2.29.17
- https://github.com/coder/coder/releases/tag/v2.32.7
- https://github.com/coder/coder/releases/tag/v2.33.8
- https://github.com/coder/coder/releases/tag/v2.34.2
- https://github.com/coder/coder/security/advisories/GHSA-wrq8-fcv5-8hvp