Executive brief
Coder, a platform for managing remote development environments, contains a security flaw in its AI Bridge Proxy component. In certain configurations, the system fails to verify the identity of the server it connects to, allowing a sophisticated attacker positioned on the network to intercept or modify sensitive data. This could lead to the exposure of development secrets or unauthorized access to the environment.
Technical details
An improper certificate validation vulnerability (CWE-295) exists in Coder's AI Bridge Proxy (`aibridgeproxyd`). The component utilized a `goproxy` server that defaulted to `InsecureSkipVerify: true` unless an upstream proxy was explicitly configured. Consequently, in default deployments, outbound HTTPS requests to the Coder access URL would accept any TLS certificate. An attacker with a man-in-the-middle (MITM) position could intercept or alter traffic between the AI Bridge Proxy and the Coder server. The vulnerability is mitigated if the components are co-located on loopback. Patches in versions 2.32.7, 2.33.8, and 2.34.2 enforce secure transport (TLS 1.2+ with system root CAs) unconditionally.
Affected products
- Coder Coder >= 2.30.0, < 2.32.7; >= 2.33.0, < 2.33.8; >= 2.34.0, < 2.34.2
Timeline
- 2026-06-08: patched: Fix merged in GitHub pull request #26131
- 2026-06-11: advisory: Security release versions 2.32.7, 2.33.8, and 2.34.2 published
- 2026-07-08: disclosed: CVE-2026-55436 published to NVD