CVE-2026-55432: Coder App Sharing Policy Bypass Vulnerability

Technical summary

The vulnerability exists in the `CreateSubAgent` RPC endpoint prior to the patched versions. The flaw is a missing validation check: when a sub-agent app is registered, the code does not verify that the requested `app sharing level` complies with the template's configured `MaxPortSharingLevel` constraint before persisting the workspace app to storage. This permits a workspace owner to register apps with sharing levels that exceed administrative policy. The root cause is an authorization enforcement gap (CWE-862: Missing Authorization) that allows policy circumvention at the application layer. Patched versions clamp the sub-agent app sharing level to the template maximum during creation, enforcing the constraint at write time.

Business impact

For organizations using Coder to isolate development workspaces and manage access to internal services, this vulnerability undermines the administrative controls intended to prevent oversharing of sensitive resources. A workspace owner could expose internal services or development artifacts beyond the intended sharing scope, increasing the risk of data leakage or unauthorized access by colleagues or external partners. The impact is constrained by the requirement that an attacker hold workspace owner status, making this a risk primarily from insider threats or compromised workspace owner accounts. Organizations that rely on Coder's sharing policies as part of their security posture should treat this as a priority for patching.

Affected systems

Coder versions prior to 2.29.7, 2.32.7, 2.33.8, and 2.34.2 are vulnerable. Organizations should check their deployed Coder version and ensure they are running one of the patched releases. The vulnerability affects any Coder deployment where workspace owners are permitted to create sub-agent apps and where `MaxPortSharingLevel` policies are configured to enforce access controls.

Exploitability

Exploitation requires the attacker to hold workspace owner privileges within a Coder workspace. This is not a remote unauthenticated attack; the attacker must either be a legitimate workspace owner or compromise an account with that role. The technical barrier to exploitation is low once access is obtained—the attacker simply needs to call the `CreateSubAgent` RPC with a sharing level higher than the template permits. The network attack surface is available (AV:N, AC:L per the CVSS vector), but the authentication prerequisite (PR:L) significantly reduces practical risk in most environments.

Remediation

Upgrade to Coder version 2.29.7, 2.32.7, 2.33.8, 2.34.2, or later depending on your current release branch. Verify the version in your deployment and apply the patch during a maintenance window. As a temporary mitigation if patching cannot be completed immediately, disable wildcard app hostnames by setting `CODER_WILDCARD_ACCESS_URL` to a non-wildcard value or leaving it unset. This blocks the subdomain-based app routing mechanism that enables the sharing bypass, though it may restrict legitimate app functionality until the patch is applied.

Patch guidance

Identify which release branch your organization is on (2.29.x, 2.32.x, 2.33.x, or 2.34.x) and upgrade to the corresponding patched version: 2.29.7 or later, 2.32.7 or later, 2.33.8 or later, or 2.34.2 or later respectively. Coder provides release notes and upgrade instructions; test the patch in a non-production environment first to confirm compatibility with your deployment. After patching, existing workspace apps will not be retroactively adjusted, so review workspaces created before the patch date if strict sharing policies are in place.

Detection guidance

Monitor audit logs for workspace owners creating or modifying sub-agent apps with sharing levels that would previously have violated policy. Look for `CreateSubAgent` RPC calls where the requested sharing level exceeds the template's `MaxPortSharingLevel`. Review workspace app configurations and compare the sharing level of registered apps against the administrator-configured maximum for their template. If wildcard hostnames are enabled, inspect DNS records and access logs for unusual subdomain patterns that may indicate app sharing beyond intended scope.

Why prioritize this

This vulnerability merits prompt but not emergency patching. It is a policy enforcement bypass rather than a critical remote code execution, and exploitation requires insider access (workspace owner role). The CVSS score of 5.4 (Medium) reflects confidentiality and integrity impacts without availability risk. Prioritize patching based on your organization's tolerance for insider threats and the sensitivity of resources exposed by Coder workspaces. Teams managing compliance-sensitive development environments should patch sooner; teams with mature insider threat controls may deprioritize slightly.

Risk score, explained

The CVSS 3.1 score of 5.4 is derived from a network-accessible service (AV:N) with low attack complexity (AC:L), requiring low-privilege authentication (PR:L, workspace owner role), no user interaction (UI:N), and a single trust boundary (S:U). The impact is limited to confidentiality (C:L, apps can be accessed beyond policy) and integrity (I:L, sharing configuration can be modified by the workspace owner), with no availability impact (A:N). The requirement for workspace owner privileges prevents higher severity scores but does not eliminate risk in environments with many developers or where account compromise is possible.

Frequently asked questions