CVE-2026-55436: Coder Information Disclosure Vulnerability

CVE-2026-55436 Overview

CVE-2026-55436 is a certificate validation flaw [CWE-295] in Coder, a platform that provisions remote development environments via Terraform. The AI Bridge Proxy component (aibridgeproxyd) created a goproxy server whose default transport set InsecureSkipVerify: true. This caused outbound HTTPS traffic to the Coder access URL to accept any TLS certificate when no upstream proxy was configured. The flaw affects Coder versions 2.30.0 through 2.32.6, 2.33.7, and 2.34.1. An attacker in a network on-path position between the AI Bridge Proxy and the Coder server can intercept and modify traffic.

Critical Impact
An on-path attacker between aibridgeproxyd and the Coder server can intercept TLS-protected traffic, exposing AI proxy credentials and session data with high confidentiality and integrity impact.

Affected Products

Coder versions 2.30.0 through 2.32.6
Coder versions 2.33.0 through 2.33.7
Coder versions 2.34.0 through 2.34.1

Discovery Timeline

2026-07-08 - CVE-2026-55436 published to NVD
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-55436

Vulnerability Analysis

The vulnerability resides in the AI Bridge Proxy daemon (aibridgeproxyd) shipped with Coder. This daemon proxies AI model traffic between Coder workspaces and upstream AI providers. The proxy uses the goproxy library to handle HTTPS interception and forwarding. In the affected releases, the default HTTP transport was configured with InsecureSkipVerify: true, disabling TLS certificate verification for outbound requests to the Coder access URL. A secure transport was only assigned when an upstream proxy was configured, leaving the default deployment path unprotected. See the GitHub Security Advisory GHSA-84rm-42xw-mx52 for the vendor analysis.

Root Cause

The root cause is Improper Certificate Validation [CWE-295]. The AI Bridge Proxy's transport initialization branched on the presence of an upstream proxy configuration. Only the upstream-proxy code path applied a hardened *http.Transport with proper tls.Config settings. The default path retained InsecureSkipVerify: true, which instructs Go's TLS stack to accept any certificate presented by the server without verifying the chain, hostname, or expiration.

Attack Vector

Exploitation requires the attacker to hold an on-path (man-in-the-middle) position between the AI Bridge Proxy and the Coder server. The attacker presents a forged TLS certificate for the Coder access URL. Because aibridgeproxyd skips verification, the connection succeeds and the attacker can decrypt, inspect, and modify traffic. Deployments where the proxy and server communicate over loopback are not exposed. Deployments that route AI Bridge Proxy traffic across untrusted network segments are at risk. No verified public exploit code is available for CVE-2026-55436.

Detection Methods for CVE-2026-55436

Indicators of Compromise

Unexpected TLS certificate fingerprints observed on connections from aibridgeproxyd to the Coder access URL.
Network flows from Coder AI Bridge Proxy hosts traversing non-loopback interfaces to reach the Coder server.
Coder deployments still running versions 2.30.0 through 2.34.1 without the security patch applied.

Detection Strategies

Inventory Coder installations and confirm the running version against the fixed releases 2.32.7, 2.33.8, and 2.34.2.
Inspect aibridgeproxyd outbound TLS handshakes and compare the presented certificate against the known Coder server certificate.
Correlate process telemetry with network telemetry to identify aibridgeproxyd communicating over non-loopback interfaces.

Monitoring Recommendations

Enable TLS inspection logging on egress paths used by Coder AI Bridge Proxy hosts.
Alert on ARP, DNS, or BGP anomalies on the network segment between the AI Bridge Proxy and the Coder control plane.
Track certificate issuer and serial number changes for the Coder access URL over time.

How to Mitigate CVE-2026-55436

Immediate Actions Required

Upgrade Coder to version 2.32.7, 2.33.8, or 2.34.2, depending on the release branch in use.
Audit AI Bridge Proxy deployments and identify any that are not co-located with the Coder server over loopback.
Rotate any credentials or tokens that traversed aibridgeproxyd on affected versions.

Patch Information

The fix is implemented in Coder pull request #26131. The patched code assigns a secure *http.Transport unconditionally, requiring TLS 1.2 or higher and validating certificates against the system root CA store. Patched builds are available at Coder v2.32.7, Coder v2.33.8, and Coder v2.34.2.

Workarounds

Configure the Coder access URL to use a certificate signed by a trusted certificate authority.
Co-locate aibridgeproxyd with the Coder server and route traffic over the loopback interface.
Deploy mutual TLS (mTLS) or a private, authenticated network tunnel between the AI Bridge Proxy and the Coder server.

bash

# Verify installed Coder version and upgrade if affected
coder version
# Example upgrade using the official install script
curl -fsSL https://coder.com/install.sh | sh -s -- --version 2.34.2
# Restart the Coder service to load the patched aibridgeproxyd
systemctl restart coder