Executive brief
Coder is a platform used by organizations to manage and deploy remote development environments. A security flaw was identified where workspace owners could bypass administrative restrictions on how development tools and ports are shared within the network. This could allow a user to expose internal applications or services more broadly than intended by the organization's security policy.
Technical details
A missing authorization check (CWE-862) exists in Coder's `CreateSubAgent` RPC. The component failed to validate a requested application sharing level against the template's `MaxPortSharingLevel` before persisting workspace applications. An attacker with the ability to register sub-agent apps in a workspace they control can exploit this to bypass administrative port-sharing restrictions. The vulnerability is addressed in versions 2.29.17, 2.32.7, 2.33.8, and 2.34.2 by clamping the sub-agent app sharing level to the template's maximum. A temporary workaround involves disabling wildcard app hostnames via the `CODER_WILDCARD_ACCESS_URL` setting.
Affected products
- Coder Coder < 2.29.17, >= 2.30.0 < 2.32.7, >= 2.33.0 < 2.33.8, >= 2.34.0 < 2.34.2
Timeline
- 2026-06-04: patched: Fix merged into main branch
- 2026-06-11: advisory: Security releases published for multiple versions
- 2026-07-08: disclosed: NVD publication date
References
- https://github.com/coder/coder/pull/26061
- https://github.com/coder/coder/releases/tag/v2.29.17
- https://github.com/coder/coder/releases/tag/v2.32.7
- https://github.com/coder/coder/releases/tag/v2.33.8
- https://github.com/coder/coder/releases/tag/v2.34.2
- https://github.com/coder/coder/security/advisories/GHSA-x9qq-2qh5-8rxf