CVE-2026-55438: Coder CORS bypass in subdomain-based workspace app proxy

CVE-2026-55438 · Severity: medium · CVSS 5.8 · Published 2026-07-08

Coder is a platform used by organizations to manage remote development environments. A security flaw in how the system handles workspace subdomains could allow an attacker to bypass security checks and read sensitive data from another user's workspace. To exploit this, an attacker would need to trick an authenticated user into visiting a specially crafted web link.

Technologies: Coder, github.com/coder/coder (Go), github.com/coder/coder/v2 (Go). Vendors: Coder, Go.

Quick answers

Is CVE-2026-55438 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-55438 being exploited in the wild.
How severe is CVE-2026-55438?
Medium severity, with a CVSS score of 5.8, published 8 July 2026.
Which products and versions are affected?
Coder < 2.29.17, >= 2.30.0 < 2.32.7, >= 2.33.0 < 2.33.8, >= 2.34.0 < 2.34.2, < 2.29.17, >= 2.30.0, < 2.32.7, >= 2.33.0, < 2.33.8, >= 2.34.0, < 2.34.2; github.com/coder/coder (Go) SEMVER:introduced=0; github.com/coder/coder/v2 (Go) SEMVER:introduced=0,fixed=2.29.17,introduced=2.30.0,fixed=2.32.7,introduced=2.33.0,fixed=2.33.8,introduced=2.34.0,fixed=2.34.2, SEMVER:introduced=2.34.0,fixed=2.34.2.
Is there a fix for CVE-2026-55438?
Yes. github.com/coder/coder/v2 (Go): upgrade to 2.34.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55438 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-55438?
Check whether you run Coder, github.com/coder/coder (Go) or github.com/coder/coder/v2 (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/coder/coder/v2 (Go): upgrade to 2.34.2 or later
    go get github.com/coder/coder/v2@v2.34.2

Technical details

A vulnerability in Coder's workspace app proxy allowed for a same-owner CORS check bypass. When a workspace-name subdomain segment was parsed as a UUID, the system resolved the workspace by ID without verifying that the username in the URL matched the actual owner. The CORS middleware subsequently trusted this unverified username from the hostname. An attacker with a valid account could craft a URL that embeds a victim's username in the hostname while serving their own workspace app, enabling credentialed cross-origin reads of the victim's responses. This requires subdomain app routing (wildcard hostnames) to be enabled and user interaction. The issue is fixed in versions 2.29.17, 2.32.7, 2.33.8, and 2.34.2 by validating the subdomain username against the authoritative owner identity.

Affected products

  • Coder Coder < 2.29.17, >= 2.30.0 < 2.32.7, >= 2.33.0 < 2.33.8, >= 2.34.0 < 2.34.2

Identifiers

  • CVE-2026-55438
  • GHSA-5wg6-jmq2-53pw
  • GO-2026-5918

Timeline

  • 2026-06-10: patched: Fix merged into main branch
  • 2026-07-08: disclosed: CVE published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.