CVE-2026-55428 Overview
Coder is a platform that provisions remote development environments through Terraform. CVE-2026-55428 affects the tailnet coordinator component, which manages WireGuard peer configurations between agents and clients. The coordinator validates that an agent's Addresses field derives from its authenticated UUID but performs no equivalent check on AllowedIPs. The coordinator forwards agent-supplied AllowedIPs verbatim to tunnel peers, which install them into WireGuard peer configuration. An authenticated agent can advertise arbitrary AllowedIPs prefixes and intercept or redirect traffic intended for other tenants. This weakness is categorized as Improper Authorization [CWE-285].
Critical Impact
An authenticated Coder agent can advertise arbitrary AllowedIPs prefixes to hijack WireGuard tunnel routing, enabling cross-tenant traffic interception and integrity compromise.
Affected Products
- Coder versions prior to 2.29.7
- Coder versions prior to 2.32.7
- Coder versions prior to 2.33.8 and prior to 2.34.2
Discovery Timeline
- 2026-07-08 - CVE-2026-55428 published to NVD
- 2026-07-08 - Last updated in NVD database
Technical Details for CVE-2026-55428
Vulnerability Analysis
The Coder tailnet coordinator brokers WireGuard peer relationships between workspace agents and connecting clients. Each agent authenticates with a UUID that scopes what network identifiers it can claim. The coordinator correctly enforces this scope for the Addresses field but omits the same check for AllowedIPs. Because AllowedIPs determines which destination prefixes a WireGuard peer will accept from that tunnel, a malicious or compromised agent can advertise prefixes it does not own. Tunnel peers install those prefixes into their WireGuard configuration verbatim. Attackers with a valid agent identity can therefore capture traffic destined for other agents or internal ranges. The flaw sits at the authorization layer and does not require breaking cryptographic primitives.
Root Cause
The root cause is missing authorization validation on the AllowedIPs field in the tailnet coordinator. The fix in versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2 validates each AllowedIPs prefix against the authenticating agent's UUID using the same logic already applied to Addresses.
Attack Vector
Exploitation requires network access to the Coder deployment and a valid, authenticated agent identity. An attacker controlling an agent registers with the coordinator and submits crafted AllowedIPs values in its node update. The coordinator relays those prefixes to peer clients, which then route matching traffic through the attacker's tunnel. Refer to the GitHub Security Advisory GHSA-wrq8-fcv5-8hvp and the remediation pull request for implementation-level detail.
Detection Methods for CVE-2026-55428
Indicators of Compromise
- Coordinator log entries showing agents advertising AllowedIPs prefixes that do not correspond to their authenticated UUID.
- WireGuard peer configurations on client tunnels containing unexpected CIDR ranges outside the agent's assigned address space.
- Unexpected traffic volume or destination changes on agent tunnels that overlap with other workspaces or internal networks.
Detection Strategies
- Parse coordinator logs for node updates and compare each AllowedIPs prefix against the agent's UUID-derived address allocation.
- Baseline the expected AllowedIPs distribution per agent and alert on deviations, additions of wide prefixes such as 0.0.0.0/0, or overlap between agents.
- Correlate agent authentication events with subsequent tunnel configuration changes to spot short-lived agents pushing broad routing claims.
Monitoring Recommendations
- Forward Coder coordinator logs to a centralized analytics platform and retain them for tunnel-configuration forensic review.
- Monitor east-west traffic between workspace tunnels for flows that violate expected tenant boundaries.
- Alert on any Coder deployment still running versions earlier than 2.29.7, 2.32.7, 2.33.8, or 2.34.2.
How to Mitigate CVE-2026-55428
Immediate Actions Required
- Upgrade Coder to a patched release: 2.29.7, 2.32.7, 2.33.8, or 2.34.2, depending on your maintenance branch.
- Audit existing coordinator logs for prior instances of agents advertising unexpected AllowedIPs prefixes.
- Rotate agent tokens after patching to invalidate any credentials that may have been used to abuse the flaw.
Patch Information
The Coder project addressed CVE-2026-55428 by validating each AllowedIPs prefix against the authenticating agent's UUID, matching the existing check for Addresses. Fixed builds are available at Coder v2.29.17, Coder v2.32.7, Coder v2.33.8, and Coder v2.34.2. Implementation details are in the GitHub Pull Request #26144.
Workarounds
- Monitor coordinator logs for agents advertising unexpected AllowedIPs prefixes and terminate offending agent sessions.
- Restrict which principals can register Coder agents to reduce the population of identities capable of exploiting the flaw.
- Segment Coder tunnel networks from sensitive internal ranges so that malicious AllowedIPs claims cannot reach high-value destinations.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
