Executive brief
Coder is a platform used by organizations to manage remote development environments. A security flaw in how the system handles workspace subdomains could allow an attacker to bypass security checks and read sensitive data from another user's workspace. To exploit this, an attacker would need to trick an authenticated user into visiting a specially crafted web link.
Technical details
A vulnerability in Coder's workspace app proxy allowed for a same-owner CORS check bypass. When a workspace-name subdomain segment was parsed as a UUID, the system resolved the workspace by ID without verifying that the username in the URL matched the actual owner. The CORS middleware subsequently trusted this unverified username from the hostname. An attacker with a valid account could craft a URL that embeds a victim's username in the hostname while serving their own workspace app, enabling credentialed cross-origin reads of the victim's responses. This requires subdomain app routing (wildcard hostnames) to be enabled and user interaction. The issue is fixed in versions 2.29.17, 2.32.7, 2.33.8, and 2.34.2 by validating the subdomain username against the authoritative owner identity.
Affected products
- Coder Coder < 2.29.17, >= 2.30.0 < 2.32.7, >= 2.33.0 < 2.33.8, >= 2.34.0 < 2.34.2
Timeline
- 2026-06-10: patched: Fix merged into main branch
- 2026-07-08: disclosed: CVE published
References
- https://github.com/coder/coder/pull/26085
- https://github.com/coder/coder/pull/26086
- https://github.com/coder/coder/releases/tag/v2.29.17
- https://github.com/coder/coder/releases/tag/v2.32.7
- https://github.com/coder/coder/releases/tag/v2.33.8
- https://github.com/coder/coder/releases/tag/v2.34.2
- https://github.com/coder/coder/security/advisories/GHSA-5wg6-jmq2-53pw