Security Flaw in Coder's Remote Development Environment Provisioning
CVE-2026-55429
What is CVE-2026-55429?
A vulnerability in Coder's Terraform-based remote development environment provisioning allows for an authorization bypass in the UpsertWorkspaceApp and insertAgentApp functions. When a primary-key conflict occurs, UpsertWorkspaceApp overwrites an existing app's agent_id without verifying its ownership of the workspace. This can lead to unauthorized cross-workspace app manipulations if an attacker has elevated permissions. The issue has been addressed in recent updates, ensuring that app IDs are properly validated against the respective workspace. Upgrading to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2 is essential to mitigate this risk.
Affected Version(s)
coder >= 2.34.0, < 2.34.2 < 2.34.0, 2.34.2
coder >= 2.33.0, < 2.33.8 < 2.33.0, 2.33.8
coder >= 2.30.0, < 2.32.7 < 2.30.0, 2.32.7