CVE-2026-55428

highPriorität · verfolgen · 0OT-Risiko · erhöhtEPSS 0.004 · 35. PerzentilEUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

0.40% (35th) EPSS

CVSS 8.2 · high

Is it mine?

13 products

Prüfe deine Angriffsfläche

Who says so?

4 sources

cnnvd · enisa_euvd · osv · nvd

EPSS · bewertet 2026-10-27

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, the tailnet coordinator validates that an agent's `Addresses` derive from its authenticated UUID but applies no equivalent check to `AllowedIPs`. The coordinator forwards agent-supplied `AllowedIPs` verbatim to tunnel peers which install them into the WireGuard peer configuration. The fix in versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2 validates each `AllowedIPs` prefix against the authenticating agent's UUID just like `Addresses`. As a workaround, monitor coordinator logs for agents advertising unexpected `AllowedIPs` prefixes.

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

8.2

010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen

v3.18.2highCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:Nsecondary · ENISA EU

v3.18.2highCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:Nsecondary · security-advisories@github.comAusnutzbarkeit 1.8 · Auswirkung 5.8

v3.18.2highCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:Nsecondary · OSV

v3.17.5highCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N/E:Usecondary · CVSS-BT (t0sche)

SSVC

Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.

Exploitation: none · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-285USCWE-285USCWE-863USCWE-863US

betroffene Produkte (13)

Betroffene Produkte und Versionsbereiche.

coder coder≤ < 2.29.17enisa_euvdEU
coder coder2.30.0, → 2.32.7enisa_euvdEU
coder coder2.33.0, → 2.33.8enisa_euvdEU
coder coder2.34.0, → 2.34.2enisa_euvdEU
coder coder< 2.29.17nvdUScpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*
coder coder2.30.0 → 2.32.7nvdUScpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*
coder coder2.33.0 → 2.33.8nvdUScpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*
coder coder2.34.0 → 2.34.2nvdUScpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*
Go github.com/coder/coderalle VersionenosvUSpkg:golang/github.com/coder/coder
Go github.com/coder/coder/v2< 2.29.17osvUSpkg:golang/github.com/coder/coder/v2
Go github.com/coder/coder/v22.30.0 → 2.32.7osvUSpkg:golang/github.com/coder/coder/v2
Go github.com/coder/coder/v22.33.0 → 2.33.8osvUSpkg:golang/github.com/coder/coder/v2
Go github.com/coder/coder/v22.34.0 → 2.34.2osvUSpkg:golang/github.com/coder/coder/v2

Advisories (2)

Hersteller- und Ökosystem-Meldungen dazu.

GHSA-wrq8-fcv5-8hvpCoder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator2026-07-06ghsa · osvUS
### Summary The tailnet coordinator validates that an agent's `Addresses` derive from its authenticated UUID but applies no equivalent check to `AllowedIPs`. The coordinator forwards agent-supplied `AllowedIPs` verbatim to tunnel peers which install them into the WireGuard peer configuration. ### Impact A malicious workspace agent can advertise arbitrary `AllowedIPs` prefixes including another agent's tailnet address. Coder's `ServerTailnet` routes to agents by tailnet IP so an agent that claims a victim's prefix can intercept web terminal and workspace app traffic and serve spoofed content. Exploitation requires an authenticated user with a running workspace and a modified agent binary. ### Patches The fix validates each `AllowedIPs` prefix against the authenticating agent's UUID just like `Addresses`. The fix was backported to all supported release lines: | Release line | Patched version | |---|---| | 2.34 | [v2.34.2](https://github.com/coder/coder/releases/tag/v2.34.2) | | 2.33 | [v2.33.8](https://github.com/coder/coder/releases/tag/v2.33.8) | | 2.32 | [v2.32.7](https://github.com/coder/coder/releases/tag/v2.32.7) | | 2.29 (ESR) | [v2.29.17](https://github.com/coder/coder/releases/tag/v2.29.17) | ### Workarounds Operators who cannot upgrade immediately should monitor coordinator logs for agents advertising unexpected `AllowedIPs` prefixes. ### Resources - Fix: #26144 ### Credits Coder would like to thank Anthropic's Security Team (ANT-2026-22451) for independently disclosing this issue!
GO-2026-5915Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder2026-07-07vendor · osvUS
Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder

auch bekannt als (5)

Weitere Namen und Kennungen dieser Entität.

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvd enisa_euvd osv nvd NVD CVE.org MITRE

veröffentlicht 2026-07-08geändert 2026-07-08

Referenzen (19)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan