CVE-2026-55438: Coder CORS Bypass in Workspace App Proxy (Medium Severity)

Technical summary

The vulnerability stems from a logical disconnect in Coder's subdomain-based workspace app proxy CORS enforcement. When a workspace-name subdomain segment is resolvable as a UUID, Coder's legacy code would resolve the workspace by ID alone without validating that the username portion of the subdomain hostname matched the workspace's actual owner. Concurrently, the CORS middleware trusted the unverified username extracted from the hostname to make same-owner decisions, rather than consulting the authoritative owner identity of the resolved workspace object. An attacker crafting a URL with a valid workspace UUID in the subdomain but a different (attacker-controlled) username could bypass the CORS check. CWE-346 (Origin Validation Error) accurately categorizes this trust-boundary violation. The CVSS 3.1 score of 5.8 (Medium) reflects the combination of low attack complexity due to the required username crafting, login privilege requirement, user interaction dependency, and scope change with high confidentiality impact if successful.

Business impact

Successful exploitation could expose sensitive workspace data and application state to unauthorized cross-origin requests made by an attacker's malicious site. Since the vulnerability requires an authenticated user to visit an attacker-controlled URL, the practical risk depends on user awareness and the sensitivity of data accessible through workspace applications. The impact is primarily informational—no code execution, lateral movement, or system compromise—but could leak source code, credentials displayed in workspace shells, or other intellectual property. Organizations running Coder in multi-tenant environments where workspace isolation is a core security boundary should treat this with appropriate urgency.

Affected systems

Coder versions prior to 2.29.17, 2.32.7, 2.33.8, and 2.34.2 are vulnerable. The flaw only manifests when subdomain-based app routing (wildcard hostname support) is enabled in the Coder deployment configuration. Organizations using path-based routing or not relying on workspace app proxies are not affected. The vulnerability applies uniformly across Coder deployments regardless of infrastructure (Kubernetes, Docker, bare metal).

Exploitability

Exploitation is not trivial in real-world conditions. An attacker must: (1) know or guess a valid workspace UUID, (2) craft a URL with that UUID as a subdomain segment and a false username, (3) socially engineer or trick an authenticated Coder user into visiting that URL, and (4) have subdomain routing enabled on the target. The attack surface is limited to users with active Coder sessions who can be induced to visit untrusted links. No public exploit code or active exploitation has been reported, and the vulnerability has not been added to the CISA KEV catalog.

Remediation

Update Coder to version 2.29.17, 2.32.7, 2.33.8, or 2.34.2 or later, depending on your current release track. The patch enforces validation of the subdomain username against the workspace owner's actual identity before allowing same-owner CORS decisions. Organizations should verify patch availability in their deployment method (Helm, Docker, package manager) before planning the upgrade. No interim workarounds are documented; the only mitigation is patching.

Patch guidance

Identify your current Coder version via the web UI (Settings > Administration > Version) or CLI (`coder version`). Locate your release track: 2.29.x, 2.32.x, 2.33.x, or 2.34.x. Upgrade to the next patch version (2.29.17+, 2.32.7+, 2.33.8+, or 2.34.2+). If you are on a version older than 2.29, consider upgrading to the latest stable release. Test the update in a non-production environment first to confirm workspace routing and app proxy functionality. Rolling out patches during low-utilization windows is recommended to minimize disruption to development teams.

Detection guidance

Monitor Coder workspace app proxy logs for requests with mismatched username/owner in subdomain and same-origin CORS decision points. Examine access logs for unusual cross-origin requests to workspace apps from unexpected referrers. Implement network-level monitoring for requests to workspace app subdomains from external or untrusted origins. If Coder audit logging is enabled, correlate timestamps of workspace app proxy requests with user authentication sessions to identify potential social engineering attempts. Retrospective detection is limited; forward-looking alerts on cross-origin workspace app requests are more effective.

Why prioritize this

This vulnerability merits timely but not emergency patching. The CVSS 5.8 score reflects medium severity, user interaction and social engineering prerequisites limit real-world attack likelihood, and no active exploitation has been observed. However, the high confidentiality impact and the simplicity of the patch justify scheduling updates within your standard patch cycle (e.g., within 30 days). Organizations with strict data segregation policies or those hosting sensitive intellectual property should prioritize sooner.

Risk score, explained

The CVSS 3.1 score of 5.8 (Medium) balances several factors: (1) network attack vector (AV:N) reflects the web-based nature, (2) high attack complexity (AC:H) captures the need to craft a valid UUID subdomain and social engineer a user, (3) low privilege requirement (PR:L) indicates an authenticated Coder user is a precondition, (4) required user interaction (UI:R) acknowledges the social engineering component, (5) changed scope (S:C) reflects potential cross-origin trust boundary violation, (6) high confidentiality impact (C:H) recognizes that workspace application data could be leaked, and (7) no integrity or availability impact (I:N/A:N). The score appropriately reflects a targeted, conditional threat rather than a widespread or easily exploitable flaw.

Frequently asked questions