CVE-2026-55429: Coder Workspace Agent Cross-Workspace Reassignment Vulnerability

Technical summary

The vulnerability stems from two distinct authorization bypass issues in Coder's workspace provisioning logic. First, `UpsertWorkspaceApp` performs a primary-key conflict resolution that overwrites the `agent_id` field on existing rows without validating the workspace context. Second, `insertAgentApp` accepts the app ID directly from the provisioner's `CompleteJob` payload without verifying that the referenced app belongs to the target workspace. Because `CompleteJob` executes under the `dbauthz.AsProvisionerd` authorization context, the standard authorization layer does not intercept the cross-workspace upsert. The fix introduces explicit workspace ownership validation in both code paths, ensuring that any workspace_apps row targeted during upsert belongs to the workspace being built, and rejecting attempts to reassign agents across workspace boundaries.

Business impact

Successful exploitation allows an insider with template authorship or provisioner operator permissions to redirect workspace agents—the compute resources executing development code—across organizational boundaries. This could enable unauthorized access to sensitive repositories, build artifacts, and development databases tied to other workspaces. For organizations using Coder to isolate development environments by team, customer, or project, this represents a data exfiltration and lateral movement risk. The requirement for elevated privileges limits the attack surface to trusted internal roles, but insider threats and compromised provisioner systems remain realistic vectors.

Affected systems

Coder versions prior to 2.29.7, 2.32.7, 2.33.8, and 2.34.2 are vulnerable. Organizations running Coder should identify which version they are deployed on and cross-reference against the patched releases. Verify your version via the Coder administrative UI or CLI before assessing patch timelines.

Exploitability

Exploitation requires authenticated access as either a template author (who defines Terraform provisioning logic) or an external provisioner operator (who manages the provisioning service). The attack cannot be executed by standard workspace users or unauthenticated actors. However, for organizations with contractor or third-party provisioner integrations, or those with broadly delegated template authorship, the threat surface may be larger than typical. The network attack vector (AV:N) reflects that Coder is typically deployed as a web service, but the high privilege requirement (PR:H) substantially constrains real-world risk.

Remediation

Upgrade to Coder 2.29.7, 2.32.7, 2.33.8, or 2.34.2 depending on your current major version line. No known workarounds exist for older versions, so patching is mandatory for affected deployments. Plan upgrades during maintenance windows, as provisioning operations should not be in flight during the upgrade. Test the upgrade in a staging environment first, particularly if your deployment includes custom provisioner integrations.

Patch guidance

Determine your current Coder version and select the appropriate patch: versions in the 2.29 line should upgrade to 2.29.7, 2.32 line to 2.32.7, 2.33 line to 2.33.8, and 2.34 line to 2.34.2. Consult the Coder release notes for any breaking changes or migration steps. Because this fix tightens validation logic, organizations with non-standard provisioning workflows should validate that legitimate workspace provisioning continues to succeed after patching. If you are running a version older than 2.29, you may need to plan a more significant upgrade path—review the Coder upgrade documentation for multi-version jumps.

Detection guidance

Monitor audit logs for unusual `UpsertWorkspaceApp` or `CompleteJob` operations, especially those that originate from provisioner service accounts or template author roles and target workspaces outside expected scope. Look for repeated failures in provisioning that may indicate an attacker probing the validation logic. If Coder logs include database query patterns, unusual agent_id reassignments across workspace boundaries would be a key signal. Organizations with centralized logging should correlate Coder activity with infrastructure access logs to detect whether redirected agents were actually used to access unintended resources.

Why prioritize this

This is a HIGH-severity vulnerability (CVSS 8.7) that affects a core function of Coder—provisioning and isolating development infrastructure. While exploitation requires elevated privileges, the scope impact (S:C) means a single successful attack can affect resources outside the immediate provisioning workspace. For organizations relying on Coder to enforce environment isolation for compliance or multi-tenancy, this represents a material risk. Patching should be prioritized within standard update cycles; there is no emergency timeframe, but deferral beyond the next planned maintenance window is not justified.

Risk score, explained

The CVSS 8.7 score reflects high impact (confidentiality and integrity both set to H) balanced against the requirement for high privilege (PR:H) and network-only attack vector. The scope change (S:C) indicates that compromised workspace agents can affect resources in other security domains. The absence of user interaction (UI:N) and low attack complexity (AC:L) mean an authenticated insider can exploit this straightforwardly. This scoring appropriately reflects the insider threat nature of the vulnerability—serious for organizations with restricted provisioner access, critical for those with broad template authorship or contractor integrations.

Frequently asked questions