CVE-2026-55430: Coder Coder CSRF Vulnerability

CVE-2026-55430 Overview

Coder is an open-source platform that provisions remote development environments through Terraform. CVE-2026-55430 affects the workspace app proxy in Coder versions prior to 2.29.7, 2.32.7, 2.33.8, and 2.34.2. The proxy resolves the target application from httpapi.RequestHost(), which prefers the X-Forwarded-Host header over the real Host header. No middleware strips this header before routing, and browsers do not forbid it, allowing client-side JavaScript to set it on fetch() calls. An attacker can route a victim's authenticated request to a different workspace application than intended.

Critical Impact
A cross-tenant workspace app routing bypass allows an attacker to redirect an authenticated victim's requests to attacker-controlled workspace apps, exposing confidential session data [CWE-345].

Affected Products

Coder versions prior to 2.29.7
Coder versions prior to 2.32.7 and 2.33.8
Coder versions prior to 2.34.2

Discovery Timeline

2026-07-08 - CVE-2026-55430 published to NVD
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-55430

Vulnerability Analysis

The Coder workspace app proxy performs host-based routing to select which workspace application should receive an incoming HTTP request. The routing logic calls httpapi.RequestHost(), a helper that prefers the X-Forwarded-Host header when present and falls back to the request's real Host header. Because no middleware strips or validates X-Forwarded-Host before the routing decision, any client that can influence this header controls where the request is directed.

The header is not on the browser's forbidden header list, so client-side JavaScript running in the victim's origin can set X-Forwarded-Host on fetch() requests. When subdomain app routing with wildcard hostnames is enabled, and the upstream reverse proxy does not sanitize the header, an attacker's shared workspace app can trigger authenticated cross-workspace requests in the victim's session.

This is an insufficient verification of data authenticity flaw [CWE-345]. The proxy trusts an untrusted client-supplied header as if it originated from a trusted upstream infrastructure component.

Root Cause

The root cause is that httpapi.RequestHost() unconditionally prioritizes X-Forwarded-Host without confirming the request came from a configured trusted proxy. Forwarded-host semantics only hold when a known reverse proxy sets the header on the network edge.

Attack Vector

Exploitation requires three preconditions: subdomain app routing with a wildcard hostname enabled on the Coder deployment, an upstream proxy that does not strip X-Forwarded-Host, and a victim who visits an attacker-shared workspace app. The attacker delivers JavaScript that issues fetch() calls with a crafted X-Forwarded-Host header pointing at a target workspace subdomain. The victim's browser sends authenticated cookies with the request, and the Coder proxy routes it to the attacker-chosen destination.

The vulnerability manifests in the request host resolution logic of the workspace app proxy. See the GitHub Security Advisory GHSA-5g4w-3vw9-478w and the remediation pull request #26204 for technical details.

Detection Methods for CVE-2026-55430

Indicators of Compromise

Incoming HTTP requests to the Coder workspace app proxy carrying an X-Forwarded-Host header value that differs from the Host header.
Requests where X-Forwarded-Host references a workspace subdomain the authenticated user does not own or normally access.
Unexpected cross-workspace access patterns in Coder audit logs, especially requests originating from browser fetch() calls.

Detection Strategies

Log both Host and X-Forwarded-Host at the reverse proxy tier and alert on mismatches from client-facing sources.
Correlate workspace app access events with the requesting user's owned workspaces to identify routing anomalies.
Monitor for JavaScript-initiated requests to workspace app endpoints that include forwarded-host headers set by browser code.

Monitoring Recommendations

Enable verbose access logging on the upstream reverse proxy fronting Coder and forward it to your SIEM for header inspection.
Track authentication cookie usage across distinct workspace hostnames per user session to detect anomalous cross-tenant activity.
Alert on any request path served by the workspace app proxy where the effective routing host was derived from X-Forwarded-Host.

How to Mitigate CVE-2026-55430

Immediate Actions Required

Upgrade Coder to 2.29.7, 2.32.7, 2.33.8, or 2.34.2 depending on your release branch.
Audit upstream reverse proxy configurations to confirm they strip or overwrite X-Forwarded-Host on untrusted requests.
Review the trusted proxy list in Coder configuration to ensure only known infrastructure addresses are permitted to set forwarded headers.

Patch Information

The fix, delivered in pull request #26204, modifies the routing logic to trust X-Forwarded-Host only when the request originates from a configured trusted proxy. Otherwise, the routing host is resolved from the verified request host. Patched releases are available in v2.29.17, v2.32.7, v2.33.8, and v2.34.2.

Workarounds

Place an upstream reverse proxy in front of Coder that strips or overwrites X-Forwarded-Host on untrusted requests.
Disable subdomain app routing with wildcard hostnames if it is not required for your workflow, removing the exploitation precondition.
Restrict workspace app sharing to trusted users until upgrade to a patched version is complete.

bash

# Example nginx configuration to strip X-Forwarded-Host on untrusted requests
location / {
    proxy_set_header Host              $host;
    proxy_set_header X-Forwarded-Host  $host;
    proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_pass http://coder_upstream;
}