CVE-2026-55431 Overview
CVE-2026-55431 affects Coder, an open-source platform that provisions remote development environments through Terraform. The vulnerability resides in the coder open app command, which opens external workspace-app URLs without validating either the scheme or the host. When an external app URL contains the $SESSION_TOKEN placeholder, the CLI substitutes the user's real session token before passing the URL to the operating system's open handler. A malicious template author can craft an external app definition that redirects the substituted token to an attacker-controlled destination. The issue is tracked as [CWE-522: Insufficiently Protected Credentials].
Critical Impact
A malicious Coder template author can steal a victim's session token when the victim runs coder open app against a workspace with an attacker-controlled external app URL.
Affected Products
- Coder versions prior to 2.29.7
- Coder versions prior to 2.32.7
- Coder versions prior to 2.33.8 and 2.34.2
Discovery Timeline
- 2026-07-08 - CVE-2026-55431 published to NVD
- 2026-07-08 - Last updated in NVD database
Technical Details for CVE-2026-55431
Vulnerability Analysis
Coder workspaces support external apps, which are template-defined links that open in the user's default handler. When a user invokes coder open app, the CLI resolves the external app URL and, if it contains the $SESSION_TOKEN placeholder, replaces it with the caller's active session token. The CLI then hands the resulting URL to the OS open handler without validating the URL scheme or the target host. This behavior allows a template author to redirect the substituted token to arbitrary destinations, including non-HTTPS schemes or hosts outside the Coder deployment.
Root Cause
The root cause is missing input validation on external app URL definitions inside the CLI. The token-substitution logic trusted any URL that appeared in a template external app definition and performed the substitution before scheme or host checks. The fix in versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2 introduces a URL-scheme allowlist and limits $SESSION_TOKEN substitution to trusted destinations such as the Coder web frontend.
Attack Vector
Exploitation requires a malicious template author to define an external app whose URL points at an attacker-controlled host and contains the $SESSION_TOKEN placeholder. The attack also requires the victim to run coder open app against a workspace using that template. Because the token is substituted client-side, the attacker receives a valid session token in an inbound HTTP request or protocol-handler invocation. The vulnerability requires user interaction and cannot be exploited without a template the attacker controls. See the GitHub Security Advisory GHSA-v54h-cp2w-9x4g for additional detail.
Detection Methods for CVE-2026-55431
Indicators of Compromise
- Coder templates that define external apps containing the literal string $SESSION_TOKEN in the URL.
- External app URLs referencing hosts outside the trusted Coder deployment domain.
- Non-HTTPS or non-standard URL schemes (for example, http://, custom protocol handlers) in external app definitions.
- Outbound requests from developer workstations to unexpected hosts immediately after coder open app invocations.
Detection Strategies
- Audit all Coder templates for external app URLs and flag any entries containing $SESSION_TOKEN.
- Compare template external app hosts against an allowlist of trusted internal domains.
- Correlate CLI process execution of coder open app with subsequent network connections from the same host to identify anomalous destinations.
Monitoring Recommendations
- Enable centralized logging of Coder CLI activity and template modification events on the Coder control plane.
- Monitor Git repositories or template registries that store Coder templates for changes to external_apps blocks.
- Alert on session-token authentication events originating from IPs outside expected developer ranges.
How to Mitigate CVE-2026-55431
Immediate Actions Required
- Upgrade Coder to 2.29.7, 2.32.7, 2.33.8, or 2.34.2 or later on all deployments.
- Rotate active session tokens for any user who ran coder open app against untrusted templates.
- Review all templates in the environment and remove or sanitize external app definitions that contain $SESSION_TOKEN or reference untrusted hosts.
Patch Information
Coder addressed the vulnerability by adding a URL-scheme allowlist in the CLI and restricting $SESSION_TOKEN substitution to trusted destinations such as the Coder web frontend. Fixed builds are available at GitHub Release v2.29.17, GitHub Release v2.32.7, GitHub Release v2.33.8, and GitHub Release v2.34.2. The upstream code change is documented in GitHub Pull Request #26146.
Workarounds
- Avoid running coder open app against workspaces backed by untrusted templates until the CLI is upgraded.
- Restrict template authorship to trusted users and require code review for any changes to external app definitions.
- Enforce a template governance policy that disallows the $SESSION_TOKEN placeholder outside the Coder web frontend host.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
