CVE-2026-55433: Coder Devcontainer Authorization Bypass (CVSS 5.4)

Technical summary

CVE-2026-55433 stems from insufficient authorization controls in Coder's devcontainer recreate endpoint. The endpoint enforces only `ActionRead` permission on the target workspace via route middleware, unlike the parallel delete endpoint which performs explicit `ActionUpdate` authorization checks. An authenticated user holding a low-privilege role with workspace access can invoke the recreate operation without triggering the `ActionUpdate` guard, permitting unauthorized destructive rebuild operations. The vulnerability is classified as CWE-862 (Missing Authorization). The fix, deployed in versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, adds explicit `ActionUpdate` authorization validation before agent communication, aligning the recreate endpoint's security posture with the delete endpoint.

Business impact

Organizations using Coder for managed remote development environments face operational disruption and data loss risk. Malicious insiders or users with compromised low-privilege accounts can trigger unauthorized environment rebuilds, destroying running workspace state without operator knowledge. This creates uncontrolled downtime for development teams, loss of unsaved work, and potential supply chain risk if Coder instances manage customer-facing development pipelines. The ability to trigger destructive actions without update permissions violates least-privilege access controls and complicates auditing.

Affected systems

Coder versions prior to 2.29.7, 2.32.7, 2.33.8, and 2.34.2 are affected. Organizations should identify all Coder instances in their environment and cross-reference deployment versions. The vulnerability requires existing workspace-level access; air-gapped or single-user Coder instances with strict authentication still require patching but present reduced exposure.

Exploitability

Exploitation is straightforward for any user with valid authentication and low-privilege workspace access. No additional credentials, network position, or user interaction is required. The attack is entirely remote and can be executed programmatically via the API. Notably, this is not a zero-day scenario requiring public exploit code—the flaw requires internal knowledge of the Coder API surface and valid credentials. The CVSS score of 5.4 (MEDIUM, with integrity and availability impact) reflects the permission prerequisite. The vulnerability does not appear on CISA's Known Exploited Vulnerabilities catalog.

Remediation

Upgrade Coder instances to patched versions: 2.29.7 or later (2.29.x line), 2.32.7 or later (2.32.x line), 2.33.8 or later (2.33.x line), or 2.34.2 or later (2.34.x line). No workarounds are available; patching is the sole mitigation path. Organizations should plan maintenance windows and validate backups before upgrades. Test patched deployments in non-production environments if possible.

Patch guidance

Apply patches from the versions specified above matching your current major.minor version. Consult the Coder release notes and vendor advisory to confirm exact patched versions for your deployment. Deploy patches to non-production instances first and validate devcontainer recreate operations function correctly post-patch. Coordinate with development teams to minimize workspace disruption. If version drift exists across multiple Coder instances, prioritize production and highly-utilized environments.

Detection guidance

Monitor Coder API audit logs for unexpected devcontainer recreate endpoint invocations, particularly from low-privilege accounts or service tokens outside normal development workflows. Alert on any recreate operations followed by agent restart or workspace state loss. Review role-based access controls to identify users holding workspace read access but lacking update permissions; those users represent the maximum blast radius if compromised. Enable verbose logging on the Coder API proxy if available.

Why prioritize this

Although the CVSS score of 5.4 is MEDIUM, the combination of low exploitation barrier (valid credentials only), destructive capability (loss of development state), and audit trail gaps (authorization bypass) warrant timely patching within standard maintenance cycles. Organizations with multi-tenant Coder instances or those supporting critical development pipelines should prioritize this higher. The absence from the KEV catalog suggests no active exploitation in the wild at publication; however, the simplicity of the attack merits proactive remediation.

Risk score, explained

The CVSS 3.1 score of 5.4 reflects a remote, low-complexity attack requiring low privilege (authenticated user), with no scope escalation, but causing integrity and availability impact. The score does not account for organizational context—loss of development environments may carry higher business consequence than the numeric rating suggests. The vulnerability is primarily an authorization control gap, not a cryptographic or memory-safety flaw, limiting but not eliminating risk.

Frequently asked questions