Executive brief
Coder is a platform used by organizations to manage and deploy remote development environments. A security vulnerability allowed users with template-authoring privileges to redirect application traffic from other users' workspaces to their own. This could result in the unauthorized interception of sensitive data or the hijacking of development tools across different teams or tenants.
Technical details
An authorization bypass exists in Coder's workspace application management. The `UpsertWorkspaceApp` function failed to verify workspace ownership when a primary-key conflict occurred, allowing an existing app's `agent_id` to be overwritten. Additionally, `insertAgentApp` accepted app IDs from the provisioner's `CompleteJob` payload without validating that the ID belonged to the workspace currently being built. Because `CompleteJob` executes with elevated database permissions (`dbauthz.AsProvisionerd`), the authorization layer did not block these cross-workspace updates. An attacker with template author or external provisioner operator privileges could exploit this to rebind a victim's application ID to their own agent, effectively proxying and intercepting cross-tenant traffic. The fix implements strict ownership verification during the upsert process.
Affected products
- Coder Coder < 2.29.17, >= 2.30.0, < 2.32.7, >= 2.33.0, < 2.33.8, >= 2.34.0, < 2.34.2
Timeline
- 2026-06-11: patched: Fix merged into main branch
- 2026-07-08: disclosed: CVE published
References
- https://github.com/coder/coder/pull/26103
- https://github.com/coder/coder/releases/tag/v2.29.17
- https://github.com/coder/coder/releases/tag/v2.32.7
- https://github.com/coder/coder/releases/tag/v2.33.8
- https://github.com/coder/coder/releases/tag/v2.34.2
- https://github.com/coder/coder/security/advisories/GHSA-9rjw-3gwp-f59v