CVE-2026-55429: Coder authorization bypass via cross-tenant workspace app rebinding

CVE-2026-55429 · Severity: high · CVSS 8.7 · Published 2026-07-08

Coder is a platform used by organizations to manage and deploy remote development environments. A security vulnerability allowed users with template-authoring privileges to redirect application traffic from other users' workspaces to their own. This could result in the unauthorized interception of sensitive data or the hijacking of development tools across different teams or tenants.

Technologies: Coder, github.com/coder/coder (Go), github.com/coder/coder/v2 (Go). Vendors: Coder, Go.

Quick answers

Is CVE-2026-55429 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-55429 being exploited in the wild.
How severe is CVE-2026-55429?
High severity, with a CVSS score of 8.7, published 8 July 2026.
Which products and versions are affected?
Coder < 2.29.17, >= 2.30.0 < 2.32.7, >= 2.33.0 < 2.33.8, >= 2.34.0 < 2.34.2, < 2.29.17, >= 2.30.0, < 2.32.7, >= 2.33.0, < 2.33.8, >= 2.34.0, < 2.34.2; github.com/coder/coder (Go) SEMVER:introduced=0; github.com/coder/coder/v2 (Go) SEMVER:introduced=0,fixed=2.29.17,introduced=2.30.0,fixed=2.32.7,introduced=2.33.0,fixed=2.33.8,introduced=2.34.0,fixed=2.34.2, SEMVER:introduced=2.34.0,fixed=2.34.2.
Is there a fix for CVE-2026-55429?
Yes. github.com/coder/coder/v2 (Go): upgrade to 2.34.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55429 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-55429?
Check whether you run Coder, github.com/coder/coder (Go) or github.com/coder/coder/v2 (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/coder/coder/v2 (Go): upgrade to 2.34.2 or later
    go get github.com/coder/coder/v2@v2.34.2

Technical details

An authorization bypass exists in Coder's workspace application management. The `UpsertWorkspaceApp` function failed to verify workspace ownership when a primary-key conflict occurred, allowing an existing app's `agent_id` to be overwritten. Additionally, `insertAgentApp` accepted app IDs from the provisioner's `CompleteJob` payload without validating that the ID belonged to the workspace currently being built. Because `CompleteJob` executes with elevated database permissions (`dbauthz.AsProvisionerd`), the authorization layer did not block these cross-workspace updates. An attacker with template author or external provisioner operator privileges could exploit this to rebind a victim's application ID to their own agent, effectively proxying and intercepting cross-tenant traffic. The fix implements strict ownership verification during the upsert process.

Affected products

  • Coder Coder < 2.29.17, >= 2.30.0, < 2.32.7, >= 2.33.0, < 2.33.8, >= 2.34.0, < 2.34.2

Identifiers

  • CVE-2026-55429
  • GHSA-9rjw-3gwp-f59v
  • GO-2026-5909

Timeline

  • 2026-06-11: patched: Fix merged into main branch
  • 2026-07-08: disclosed: CVE published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.