CORS Bypass Vulnerability in Coder's Remote Development Environments
CVE-2026-55438
What is CVE-2026-55438?
The vulnerability in Coder's subdomain-based workspace app proxy allows attackers to bypass the same-owner CORS check. This issue arises when a workspace-name subdomain segment is erroneously parsed as a UUID, granting access based solely on the subdomain without verifying the authenticity of the owning username. Consequently, if subdomain app routing is enabled and a user interacts with a malicious URL crafted by the attacker while authenticated, exploitation can occur. The updates in Coder versions 2.29.17, 2.32.7, 2.33.8, and 2.34.2 introduce a fix that enforces proper validation of subdomain usernames against the workspace’s actual owner, thus strengthening the CORS decision-making process. No workarounds are available to mitigate this risk.
Affected Version(s)
coder >= 2.34.0, < 2.34.2 < 2.34.0, 2.34.2
coder >= 2.33.0, < 2.33.8 < 2.33.0, 2.33.8
coder >= 2.30.0, < 2.32.7 < 2.30.0, 2.32.7