CVE-2026-55435 Details
Description
Coder allows organizations to provision remote development environments via Terraform. Starting in version 2.30.0 and prior to versions 2.32.7, 2.33.8, and 2.34.2, AI Bridge proxy endpoints authenticate via `Server.IsAuthorized` in `coderd/aibridgedserver`, which validates key format, expiry, secret and deleted or system users but does not check whether the account is suspended. Because suspension does not revoke existing API keys, a suspended user's unexpired token keeps working. Practical impact is limited to already-issued API keys of suspended users until those keys are deleted. Versions 2.32.7, 2.33.8, and 2.34.2 patch the issue. As a workaround, on suspension, delete the user's API keys via `DELETE /api/v2/users/{user}/keys`.
A vulnerability exists in Coder's AI Bridge proxy endpoints, which authenticate using a method that fails to verify if a user's account is suspended. This issue affects Coder versions 2.30.0 prior to 2.32.7, 2.33.0 prior to 2.33.8, and 2.34.0 prior to 2.34.2. When a user is suspended, their API keys remain active until manually deleted, allowing continued access to AI Bridge services. The vulnerability could lead to unauthorized usage of paid resources and, if certain tools are enabled, the execution of those tools.
Upgrade to Coder versions 2.32.7, 2.33.8, or 2.34.2, all of which include the necessary fix. After upgrading, ensure that any API keys for suspended users are deleted to prevent unauthorized access.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 9, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/coder/coder/commit/0d2c9f904a8b75b888140fcc8fbf4633660cc787 | [email protected] | Patch |
| https://github.com/coder/coder/pull/26164 | [email protected] | Issue TrackingPatch |
| https://github.com/coder/coder/pull/26173 | [email protected] | Issue TrackingPatch |
| https://github.com/coder/coder/releases/tag/v2.32.7 | [email protected] | Release Notes |
| https://github.com/coder/coder/releases/tag/v2.33.8 | [email protected] | Release Notes |
| https://github.com/coder/coder/releases/tag/v2.34.2 | [email protected] | Release Notes |
| https://github.com/coder/coder/security/advisories/GHSA-wqxv-w64v-5wh6 | [email protected] | PatchVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| coder coder | >= 2.30.0, < 2.32.7 >= 2.33.0, < 2.33.8 >= 2.34.0, < 2.34.2 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 9, 2026 | CVE Modified | CISA-ADP |
| Jul 8, 2026 | Initial Analysis | [email protected] |
| Jul 7, 2026 | New CVE Received | [email protected] |