CVE-2026-55432
mediumpriority · track · 0OT risk · elevatedEPSS 0.003 · 24 %ileEUUSEPSS · scored 2026-10-27
Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, the `CreateSubAgent` RPC did not validate a requested app sharing level against the template's `MaxPortSharingLevel` before persisting workspace apps, letting a workspace owner exceed the administrator's configured maximum. Exploitation requires the ability to register sub-agent apps in a workspace the attacker controls. The fix in versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2clamps the sub-agent app sharing level to the template's `MaxPortSharingLevel`. As a workaround, disable wildcard app hostnames (`CODER_WILDCARD_ACCESS_URL`) to block subdomain-based app routing.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (13)
Products and version ranges known to be affected.
advisories (2)
Vendor and ecosystem advisories describing this.
- GHSA-x9qq-2qh5-8rxfCoder's sub-agent app registration bypasses template port-sharing policy enforcement2026-07-06ghsa · osvUS
### Summary The `CreateSubAgent` RPC did not validate a requested app sharing level against the template's `MaxPortSharingLevel` before persisting workspace apps, letting a workspace owner exceed the administrator's configured maximum. > **Note:** Exploitation requires the ability to register sub-agent apps in a workspace the attacker controls. ### Impact A workspace owner with an agent token could register a sub-agent app as `PUBLIC` even when the template's `MaxPortSharingLevel` was `owner`, exposing the app to unauthenticated users via the wildcard app domain. This affected only deployments using Enterprise port-sharing policy and wildcard app hostnames and required an authenticated workspace owner with an agent token. ### Patches The fix clamps the sub-agent app sharing level to the template's `MaxPortSharingLevel`. The fix was backported to all supported release lines: | Release line | Patched version | |---|---| | 2.34 | [v2.34.2](https://github.com/coder/coder/releases/tag/v2.34.2) | | 2.33 | [v2.33.8](https://github.com/coder/coder/releases/tag/v2.33.8) | | 2.32 | [v2.32.7](https://github.com/coder/coder/releases/tag/v2.32.7) | | 2.29 (ESR) | [v2.29.17](https://github.com/coder/coder/releases/tag/v2.29.17) | ### Workarounds Disable wildcard app hostnames (`CODER_WILDCARD_ACCESS_URL`) to block subdomain-based app routing. ### Resources - Fix: #26061 ### Credits Coder would like to thank Anthropic's Security Team (ANT-2026-22452) for independently disclosing this issue!
- GO-2026-5926Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder2026-07-07vendor · osvUS
Coder's sub-agent app registration bypasses template port-sharing policy enforcement in github.com/coder/coder
also known as (5)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (19)
External citations — patches, advisories, analysis.
- https://github.com/coder/coder/pull/26061cnnvd
- https://github.com/coder/coder/releasesPatchcnnvd
- https://github.com/coder/coder/releases/tag/v2.29.17cnnvd
- https://github.com/coder/coder/releases/tag/v2.32.7cnnvd
- https://github.com/coder/coder/releases/tag/v2.33.8cnnvd
- https://github.com/coder/coder/releases/tag/v2.34.2cnnvd
- https://github.com/coder/coder/security/advisories/GHSA-x9qq-2qh5-8rxfcnnvd
- https://github.com/coder/coder/pull/26061enisa_euvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan