# CVE-2026-55438: Coder CORS bypass in subdomain-based workspace app proxy

Source: https://junglewise.ai/threats/cve-2026-55438-coder-cors-bypass-in-subdomain-based-workspace-app-proxy  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-08. Updated: 2026-07-08  
License: CC BY 4.0 with a link back

CVE-2026-55438 · Severity: medium · CVSS 5.8 · Published 2026-07-08

Coder is a platform used by organizations to manage remote development environments. A security flaw in how the system handles workspace subdomains could allow an attacker to bypass security checks and read sensitive data from another user's workspace. To exploit this, an attacker would need to trick an authenticated user into visiting a specially crafted web link.

Technologies: [Coder](https://junglewise.ai/threats/technologies/coder), [github.com/coder/coder (Go)](https://junglewise.ai/threats/technologies/github-com-coder-coder), [github.com/coder/coder/v2 (Go)](https://junglewise.ai/threats/technologies/github-com-coder-coder-v2). Vendors: [Coder](https://junglewise.ai/threats/vendors/coder), [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-55438 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-55438 being exploited in the wild.

**How severe is CVE-2026-55438?** Medium severity, with a CVSS score of 5.8, published 8 July 2026.

**Which products and versions are affected?** Coder < 2.29.17, >= 2.30.0 < 2.32.7, >= 2.33.0 < 2.33.8, >= 2.34.0 < 2.34.2, < 2.29.17, >= 2.30.0, < 2.32.7, >= 2.33.0, < 2.33.8, >= 2.34.0, < 2.34.2; github.com/coder/coder (Go) SEMVER:introduced=0; github.com/coder/coder/v2 (Go) SEMVER:introduced=0,fixed=2.29.17,introduced=2.30.0,fixed=2.32.7,introduced=2.33.0,fixed=2.33.8,introduced=2.34.0,fixed=2.34.2, SEMVER:introduced=2.34.0,fixed=2.34.2.

**Is there a fix for CVE-2026-55438?** Yes. github.com/coder/coder/v2 (Go): upgrade to 2.34.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-55438 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-55438?** Check whether you run Coder, github.com/coder/coder (Go) or github.com/coder/coder/v2 (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/coder/coder/v2 (Go): upgrade to 2.34.2 or later

  ```sh
  go get github.com/coder/coder/v2@v2.34.2
  ```


## Technical details

A vulnerability in Coder's workspace app proxy allowed for a same-owner CORS check bypass. When a workspace-name subdomain segment was parsed as a UUID, the system resolved the workspace by ID without verifying that the username in the URL matched the actual owner. The CORS middleware subsequently trusted this unverified username from the hostname. An attacker with a valid account could craft a URL that embeds a victim's username in the hostname while serving their own workspace app, enabling credentialed cross-origin reads of the victim's responses. This requires subdomain app routing (wildcard hostnames) to be enabled and user interaction. The issue is fixed in versions 2.29.17, 2.32.7, 2.33.8, and 2.34.2 by validating the subdomain username against the authoritative owner identity.

## Affected products

- Coder Coder < 2.29.17, >= 2.30.0 < 2.32.7, >= 2.33.0 < 2.33.8, >= 2.34.0 < 2.34.2

## Identifiers

- CVE-2026-55438
- GHSA-5wg6-jmq2-53pw
- GO-2026-5918

## Timeline

- 2026-06-10: patched: Fix merged into main branch
- 2026-07-08: disclosed: CVE published

## References

- [https://github.com/coder/coder/pull/26085](https://github.com/coder/coder/pull/26085)
- [https://github.com/coder/coder/pull/26086](https://github.com/coder/coder/pull/26086)
- [https://github.com/coder/coder/releases/tag/v2.29.17](https://github.com/coder/coder/releases/tag/v2.29.17)
- [https://github.com/coder/coder/releases/tag/v2.32.7](https://github.com/coder/coder/releases/tag/v2.32.7)
- [https://github.com/coder/coder/releases/tag/v2.33.8](https://github.com/coder/coder/releases/tag/v2.33.8)
- [https://github.com/coder/coder/releases/tag/v2.34.2](https://github.com/coder/coder/releases/tag/v2.34.2)
- [https://github.com/coder/coder/security/advisories/GHSA-5wg6-jmq2-53pw](https://github.com/coder/coder/security/advisories/GHSA-5wg6-jmq2-53pw)

## Related threats

- [Coder AI Gateway encoded path traversal](https://junglewise.ai/threats/cve-2026-121967-coder-2-28-0-before-2-29-22-2-30-0-before-2-34-13-2-35-0-before)
- [Coder missing audience validation in GCP instance-identity endpoint](https://junglewise.ai/threats/cve-2026-118687-coder-before-2-29-21-2-30-0-before-2-34-12-2-35-0-before-2-35-9)
- [Coder open redirect in workspace app proxy](https://junglewise.ai/threats/cve-2026-111931-coder-from-2-0-0-before-2-34-8-contains-an-open-redirect)
- [Coder workspace ACL endpoint authorization bypass](https://junglewise.ai/threats/cve-2026-111930-coder-from-2-26-0-before-2-34-8-contains-an-incorrect)
- [Coder provisioner daemon authorization bypass in DownloadFile](https://junglewise.ai/threats/cve-2026-111929-coder-from-2-30-0-before-2-34-8-contains-an-authorization-bypass)