CVE-2026-55436: Coder AI Bridge Proxy TLS Certificate Validation Bypass (CVSS 7.4)

Technical summary

The vulnerability resides in the Go proxy server instantiated by aibridgeproxyd. The code path that constructs the default HTTP transport sets InsecureSkipVerify: true, disabling hostname and certificate verification. A secure transport (TLS 1.2+ with system root CAs) is only applied conditionally when an upstream proxy is configured. In the default case—no upstream proxy—all outbound HTTPS connections from the AI Bridge Proxy to the Coder access URL bypass certificate validation. This violates CWE-295 (improper certificate validation). Exploitation requires network-level access (man-in-the-middle position) and is feasible with tools like mitmproxy or similar intercepting proxies. Patched versions apply the secure transport unconditionally, removing the configuration dependency.

Business impact

A compromised connection between the AI Bridge Proxy and Coder server could expose session tokens, API credentials, or user code and configuration data transiting between components. For organizations using Coder to manage development environments across teams, this creates a channel for credential harvesting or lateral movement into downstream development infrastructure. The practical blast radius is limited to network segments where both components coexist; cloud or multi-datacenter deployments with internet-facing Coder servers face lower risk if internal network segmentation is strong. Regulatory concerns arise in environments handling sensitive intellectual property or compliance-regulated code.

Affected systems

Coder versions 2.30.0 through 2.34.1 are affected. Patched versions are 2.32.7 (for the 2.32.x line), 2.33.8 (for the 2.33.x line), and 2.34.2 (for the 2.34.x line and later). Organizations should verify their deployed version via coder version or equivalent CLI. The AI Bridge Proxy component must be running to introduce risk; standalone Coder server deployments without the proxy are unaffected. Check your Coder deployment to confirm whether aibridgeproxyd is active in your architecture.

Exploitability

The attack vector is network-adjacent; an attacker must occupy a man-in-the-middle position between the proxy and server. In practice, this means the attacker controls routing, network interfaces, or DNS in the path (e.g., compromised gateway, rogue Wi-Fi access point, or BGP hijacking in extreme cases). Deployments with Coder and the AI Bridge Proxy on the same host communicating over loopback (127.0.0.1) are effectively immune because local loopback traffic cannot be intercepted from the network. Public-cloud deployments with strong network isolation (VPCs, security groups, private subnets) reduce exposure. CVSS score 7.4 reflects the high-impact confidentiality and integrity loss balanced against the non-trivial access requirement. No user interaction or privilege escalation is required once the attacker is on the network path.

Remediation

Upgrade to patched versions as soon as feasible: 2.32.7, 2.33.8, or 2.34.2 depending on your current line. Verify the upgrade via version output and confirm aibridgeproxyd is running the new binary. As an immediate interim measure, implement network-level protections: restrict network paths between the AI Bridge Proxy and Coder server to loopback or dedicated private networks, and enforce mTLS on that connection if the proxy supports it. Ensure the Coder access URL uses a certificate signed by a trusted CA; self-signed certificates do not mitigate the InsecureSkipVerify bug. Monitor for any unusual certificate validation bypasses or TLS warnings in proxy logs.

Patch guidance

Apply updates in this order: (1) test patches in a non-production environment first; (2) drain active workloads from the AI Bridge Proxy before restarting; (3) replace the aibridgeproxyd binary with the patched version; (4) restart the proxy and verify it reconnects to the Coder server without errors. Patch applicability depends on your current version: if running 2.32.x, upgrade to 2.32.7; if 2.33.x, upgrade to 2.33.8; if 2.34.x or later, upgrade to 2.34.2 or the latest available in that series. Coder vendor advisories will provide detailed rollout procedures. Plan 15–30 minutes of maintenance window per environment.

Detection guidance

Review logs from aibridgeproxyd and the Coder server for unusual TLS errors or certificate validation warnings—patched versions will enforce strict validation and may surface latent misconfiguration. Check network traffic between the proxy and server using packet capture (tcpdump, Wireshark) for plaintext HTTP fallback or unexpected certificate subjects. Confirm via coder version that all instances are running patched binaries. Periodically audit your deployment topology to ensure the proxy and server are on trusted network segments; if they traverse untrusted links, escalate to urgent remediation. Consider enabling mutual TLS (mTLS) for this connection if supported by your Coder configuration as a defense-in-depth measure.

Why prioritize this

HIGH severity due to confidentiality and integrity impact (CVSS 7.4), but prioritize by deployment topology. Organizations running Coder and AI Bridge Proxy on the same host over loopback should deprioritize this issue; they face negligible practical risk. Those with proxy and server on different hosts, especially across network boundaries or in shared infrastructure, should patch within 1–2 weeks. Deployments exposed to hostile or untrusted networks (DMZ, multi-tenant cloud, internet-facing) warrant urgent patching within days. The lack of KEV designation suggests no known wild exploitation to date, allowing some scheduling flexibility, but the ease of network-level exploitation on affected paths argues against deferral for exposed deployments.

Risk score, explained

CVSS 7.4 (HIGH) reflects a network-reachable vulnerability with high impact on confidentiality (credential and data exposure) and integrity (potential for request tampering), but with a non-trivial attack complexity due to the MitM requirement. The scope is unchanged (no privilege escalation or multi-party impact). This score appropriately ranks the issue as serious for organizations with separate proxy and server instances in shared or untrusted networks, while acknowledging that loopback or air-gapped deployments face substantially lower real-world risk. Organizations should adjust their internal risk ratings based on whether their topology matches the vulnerable scenario.

Frequently asked questions