CVE-2026-55432 Details
Description
Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, the `CreateSubAgent` RPC did not validate a requested app sharing level against the template's `MaxPortSharingLevel` before persisting workspace apps, letting a workspace owner exceed the administrator's configured maximum. Exploitation requires the ability to register sub-agent apps in a workspace the attacker controls. The fix in versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2clamps the sub-agent app sharing level to the template's `MaxPortSharingLevel`. As a workaround, disable wildcard app hostnames (`CODER_WILDCARD_ACCESS_URL`) to block subdomain-based app routing.
A vulnerability exists in Coder's remote development environment provisioning via Terraform. In versions prior to 2.29.7, 2.32.7, 2.33.8, and 2.34.2, the 'CreateSubAgent' RPC failed to validate app sharing levels against the template's 'MaxPortSharingLevel'. This oversight allowed workspace owners to exceed administrator-set limits. Exploitation requires an authenticated workspace owner with an agent token to register sub-agent apps in their workspace.
Upgrade to Coder versions 2.29.17, 2.32.7, 2.33.8, or 2.34.2. For instructions, refer to the Coder documentation on installation and upgrading.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/coder/coder/pull/26061 | [email protected] | Issue TrackingPatch |
| https://github.com/coder/coder/releases/tag/v2.29.17 | [email protected] | Release Notes |
| https://github.com/coder/coder/releases/tag/v2.32.7 | [email protected] | Release Notes |
| https://github.com/coder/coder/releases/tag/v2.33.8 | [email protected] | Release Notes |
| https://github.com/coder/coder/releases/tag/v2.34.2 | [email protected] | Release Notes |
| https://github.com/coder/coder/security/advisories/GHSA-x9qq-2qh5-8rxf | [email protected] | PatchVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| coder coder | < 2.29.17 >= 2.30.0, < 2.32.7 >= 2.33.0, < 2.33.8 >= 2.34.0, < 2.34.2 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 8, 2026 | Initial Analysis | [email protected] |
| Jul 8, 2026 | CVE Modified | CISA-ADP |
| Jul 8, 2026 | New CVE Received | [email protected] |