Remote Development Environment Configuration Issue in Coder by Coder
CVE-2026-55428
What is CVE-2026-55428?
A vulnerability in Coder’s configuration of remote development environments allows agents to directly supply their AllowedIPs without proper validation against their authenticated UUID. This oversight means that malicious actors could potentially inject arbitrary IPs, which are then passed directly to tunnel peers for WireGuard configurations. The issue was addressed in versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, where the validation mechanism for AllowedIPs was improved to align with the current checks for Addresses. Users are advised to monitor coordinator logs for any entries that exhibit unexpected AllowedIPs to mitigate potential risks.
Affected Version(s)
coder >= 2.34.0, < 2.34.2 < 2.34.0, 2.34.2
coder >= 2.33.0, < 2.33.8 < 2.33.0, 2.33.8
coder >= 2.30.0, < 2.32.7 < 2.30.0, 2.32.7