Remote Development Environment Provisioning Flaw in Coder by Coder
CVE-2026-55432
What is CVE-2026-55432?
The vulnerability in Coder's remote development environment provision allows workspace owners to exceed the maximum configured app sharing levels by exploiting the 'CreateSubAgent' RPC functionality. Earlier versions do not properly validate the requested app sharing level against the designated template's constraints, potentially leading to unauthorized app sharing within a workspace. To mitigate risks, users must update to versions 2.29.7, 2.32.7, 2.33.8, or 2.34.2, where the validation issue has been resolved. Alternatively, disabling wildcard app hostnames can provide a temporary workaround against potential exploits.
Affected Version(s)
coder >= 2.34.0, < 2.34.2 < 2.34.0, 2.34.2
coder >= 2.33.0, < 2.33.8 < 2.33.0, 2.33.8
coder >= 2.30.0, < 2.32.7 < 2.30.0, 2.32.7