CVE-2026-55432: Coder Privilege Escalation Vulnerability

CVE-2026-55432 Overview

Coder is a platform that provisions remote development environments through Terraform. CVE-2026-55432 is a missing authorization vulnerability [CWE-862] in the CreateSubAgent remote procedure call (RPC). The RPC failed to validate a requested app sharing level against the template's MaxPortSharingLevel before persisting workspace apps. A workspace owner could exceed the administrator's configured maximum sharing level for sub-agent apps. The issue affects Coder versions prior to 2.29.7, 2.32.7, 2.33.8, and 2.34.2.

Critical Impact
An authenticated workspace owner can bypass template-enforced port sharing restrictions and expose sub-agent applications beyond the administrator's intended access boundary.

Affected Products

Coder versions prior to 2.29.7
Coder versions prior to 2.32.7, 2.33.8
Coder versions prior to 2.34.2

Discovery Timeline

2026-07-08 - CVE-2026-55432 published to NVD
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-55432

Vulnerability Analysis

Coder templates define a MaxPortSharingLevel that administrators use to cap how broadly workspace apps can be shared. Valid sharing levels typically range from owner-only to organization-wide or public exposure. The CreateSubAgent RPC accepted a client-supplied sharing level for sub-agent workspace apps and wrote it directly to storage. The server did not compare the requested level to the template ceiling.

Because enforcement occurred elsewhere in the codebase for standard workspace apps but was absent on the sub-agent path, a workspace owner could register sub-agent apps with a sharing level higher than the template permits. This allows unauthorized exposure of development workloads that administrators expected to remain private or scoped.

Root Cause

The root cause is a missing authorization check on the CreateSubAgent RPC. The handler persisted workspace app records without clamping the SharingLevel field to the template's MaxPortSharingLevel. The fix, delivered in pull request #26061, clamps the sub-agent app sharing level to the template's configured maximum before persistence.

Attack Vector

Exploitation requires authenticated access to a workspace the attacker controls, along with the ability to register sub-agent apps. The attacker submits a CreateSubAgent RPC that specifies a sharing level higher than the template's MaxPortSharingLevel. The server accepts the value and stores the app with elevated sharing. If wildcard app hostnames are enabled through CODER_WILDCARD_ACCESS_URL, the app becomes reachable via subdomain-based routing at the elevated level.

The vulnerability affects confidentiality and integrity of workspace app exposure policy. No code execution or remote unauthenticated access is granted through this flaw.

Detection Methods for CVE-2026-55432

Indicators of Compromise

Workspace app records with a SharingLevel value that exceeds the parent template's MaxPortSharingLevel setting.
Sub-agent app registrations originating from CreateSubAgent RPC calls made by non-administrator workspace owners.
Unexpected subdomain-based access to sub-agent apps through the wildcard access URL.

Detection Strategies

Query the Coder database for workspace apps where sharing_level is greater than the associated template's max_port_sharing_level and treat mismatches as evidence of exploitation.
Audit CreateSubAgent RPC logs for requests where the requested sharing level differs from the template ceiling.
Correlate sub-agent app creation events with subsequent external HTTP requests to workspace subdomains.

Monitoring Recommendations

Enable structured audit logging on the Coder control plane and forward workspace_app create and update events to a central log store.
Alert on any workspace app whose sharing level changes to public or organization outside of an administrator-initiated template update.
Track access patterns on wildcard hostnames and flag traffic to sub-agent app routes.

How to Mitigate CVE-2026-55432

Immediate Actions Required

Upgrade Coder deployments to version 2.29.7, 2.32.7, 2.33.8, or 2.34.2, matching the release train currently in production.
Review existing workspace apps for sharing levels that exceed the template's MaxPortSharingLevel and reset non-compliant records.
Restrict template creation and sub-agent registration to trusted users until the upgrade is complete.

Patch Information

The fix is available in Coder releases v2.29.17, v2.32.7, v2.33.8, and v2.34.2. The code change is documented in GitHub Pull Request #26061 and the GHSA-x9qq-2qh5-8rxf advisory. The patch clamps the sub-agent app SharingLevel to the template's MaxPortSharingLevel at the point of persistence.

Workarounds

Disable wildcard app hostnames by unsetting or clearing CODER_WILDCARD_ACCESS_URL to block subdomain-based app routing.
Set the template MaxPortSharingLevel to the most restrictive value (owner) until patched binaries are deployed.
Remove the ability for untrusted users to author templates or register sub-agent apps in production organizations.

bash

# Disable wildcard app hostnames to block subdomain-based app routing
unset CODER_WILDCARD_ACCESS_URL

# Verify current Coder server version
coder version

# Upgrade example for a Coder deployment (adjust to your release train)
# Replace <target-version> with 2.29.7, 2.32.7, 2.33.8, or 2.34.2
docker pull ghcr.io/coder/coder:v<target-version>