CVE-2026-55433 Overview
Coder is a platform that provisions remote development environments through Terraform. CVE-2026-55433 is a missing authorization vulnerability [CWE-862] in the devcontainer recreate endpoint. The route middleware verified only ActionRead on the target workspace and skipped the ActionUpdate check performed by the sibling delete endpoint. A low-privilege user with read access to a workspace can trigger a destructive devcontainer rebuild without holding update rights. The issue affects Coder versions prior to 2.29.7, 2.32.7, 2.33.8, and 2.34.2.
Critical Impact
An authenticated low-privilege user with read access to a workspace can force a devcontainer rebuild, disrupting the target environment and potentially destroying in-progress work.
Affected Products
- Coder versions prior to 2.29.7
- Coder versions prior to 2.32.7
- Coder versions prior to 2.33.8 and prior to 2.34.2
Discovery Timeline
- 2026-07-08 - CVE-2026-55433 published to NVD
- 2026-07-08 - Last updated in NVD database
Technical Details for CVE-2026-55433
Vulnerability Analysis
Coder exposes a devcontainer recreate endpoint that dials the workspace agent to tear down and rebuild the development container. The endpoint shares route middleware with sibling handlers, but the authorization policy applied to it was incomplete. The middleware evaluated ActionRead on the workspace resource and permitted the request to proceed. The sibling delete handler, which performs a similarly destructive operation, correctly enforces ActionUpdate before continuing.
Because devcontainer recreation destroys the running container and rebuilds it from source, the operation is semantically equivalent to an update or delete action. Treating it as a read operation collapses two distinct authorization boundaries into one and allows viewers to perform state-changing actions. The vulnerability is scoped to authenticated principals who already hold a role granting read access to the target workspace.
Root Cause
The root cause is a missing authorization check in the devcontainer recreate route. The handler relied on middleware verifying ActionRead rather than issuing an explicit ActionUpdate check against the workspace before dialing the agent. This is a classic instance of CWE-862: Missing Authorization, where a sensitive operation is gated by a weaker permission than its impact requires.
Attack Vector
Exploitation is performed over the network against the Coder control plane. The attacker must authenticate with a role that has read access to a target workspace. Once authenticated, the attacker issues a request to the devcontainer recreate endpoint, which triggers the workspace agent to tear down and rebuild the container. No user interaction on the victim side is required. See the GitHub Security Advisory GHSA-jqj2-x4c5-jfxm for maintainer-authored technical detail.
No verified public exploit code is available for this issue, and it is not listed in the CISA Known Exploited Vulnerabilities catalog.
Detection Methods for CVE-2026-55433
Indicators of Compromise
- Requests to the devcontainer recreate API endpoint originating from user principals that hold only read-level workspace roles.
- Unexpected devcontainer rebuild events in workspace audit logs, particularly outside of maintenance windows.
- Workspace agents reporting container teardown and reprovisioning without a corresponding update or deploy action from an authorized operator.
Detection Strategies
- Correlate Coder audit log entries for devcontainer recreate calls against the caller's RBAC role and flag calls from users lacking ActionUpdate on the workspace.
- Alert on repeated recreate requests targeting the same workspace within a short time window, which suggests intentional disruption.
- Baseline the normal rate of devcontainer rebuilds per workspace owner and surface deviations initiated by non-owners.
Monitoring Recommendations
- Ship Coder server audit logs and workspace agent logs to a centralized logging platform for correlation with identity events.
- Monitor authentication logs for low-privilege accounts issuing state-changing API calls to /api/v2/workspaceagents/*/containers/devcontainers/*/recreate style routes.
- Track workspace lifecycle metrics such as rebuild frequency and unexpected agent reconnection storms.
How to Mitigate CVE-2026-55433
Immediate Actions Required
- Upgrade Coder to 2.29.7, 2.32.7, 2.33.8, or 2.34.2 depending on the deployed release train.
- Audit existing workspace role assignments and remove read-level access from principals who do not require it.
- Review recent audit logs for devcontainer recreate calls performed by non-owners and validate whether any workspaces were disrupted.
Patch Information
The fix is delivered in Coder 2.29.7, 2.32.7, 2.33.8, and 2.34.2. The patch adds an explicit ActionUpdate authorization check on the workspace before the server dials the agent, aligning the recreate endpoint with the delete endpoint. Refer to the Coder pull request #25812 and the GitHub Security Advisory GHSA-jqj2-x4c5-jfxm for the code change and vendor guidance. Release notes are available for v2.29.17, v2.32.7, v2.33.8, and v2.34.2.
Workarounds
- No vendor-provided workarounds are available. Upgrading to a fixed release is the only supported remediation.
- As a compensating control, restrict workspace read access to the smallest set of users required until the patch is applied.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
