CVE-2026-55435: Coder incorrect authorization for suspended users in AI Bridge proxy

CVE-2026-55435 · Severity: medium · CVSS 5.4 · Published 2026-07-07

Coder, a platform for managing remote development environments, contains a flaw where suspended users can still access certain AI Bridge proxy services. While an administrator may have deactivated a user's account, any previously issued and unexpired API keys remain functional for these specific endpoints. This could allow a former employee or unauthorized user to continue using company resources until their specific API keys are manually deleted or expire.

Technologies: Coder, github.com/coder/coder (Go), github.com/coder/coder/v2 (Go). Vendors: Coder, Go.

Quick answers

Is CVE-2026-55435 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-55435 being exploited in the wild.
How severe is CVE-2026-55435?
Medium severity, with a CVSS score of 5.4, published 7 July 2026.
Which products and versions are affected?
Coder >= 2.30.0, < 2.32.7; >= 2.33.0, < 2.33.8; >= 2.34.0, < 2.34.2; github.com/coder/coder (Go) SEMVER:introduced=0; github.com/coder/coder/v2 (Go) SEMVER:introduced=2.30.0,fixed=2.32.7,introduced=2.33.0,fixed=2.33.8,introduced=2.34.0,fixed=2.34.2, SEMVER:introduced=2.34.0,fixed=2.34.2.
Is there a fix for CVE-2026-55435?
Yes. github.com/coder/coder/v2 (Go): upgrade to 2.34.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55435 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-55435?
Check whether you run Coder, github.com/coder/coder (Go) or github.com/coder/coder/v2 (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/coder/coder/v2 (Go): upgrade to 2.34.2 or later
    go get github.com/coder/coder/v2@v2.34.2

Technical details

An incorrect authorization vulnerability (CWE-863) exists in Coder's AI Bridge proxy endpoints. The authentication logic in `Server.IsAuthorized` within `coderd/aibridgedserver` validates API key format, expiration, and secrets, but fails to verify the 'active' status of the user account. Consequently, account suspension does not automatically invalidate existing session tokens or API keys for these specific endpoints. An attacker with a previously issued, unexpired API key can continue to proxy requests through the AI Bridge despite being suspended. This issue is resolved in versions 2.32.7, 2.33.8, and 2.34.2.

Affected products

  • Coder Coder >= 2.30.0, < 2.32.7; >= 2.33.0, < 2.33.8; >= 2.34.0, < 2.34.2

Identifiers

  • CVE-2026-55435
  • GHSA-wqxv-w64v-5wh6
  • GO-2026-5925

Timeline

  • 2026-06-09: patched: Fix committed to main branch
  • 2026-06-11: advisory: Security release tags v2.32.7, v2.33.8, and v2.34.2 published
  • 2026-07-07: disclosed: CVE-2026-55435 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.