CVE-2026-55438: Coder Authentication Bypass Vulnerability

CVE-2026-55438 Overview

CVE-2026-55438 is a same-origin authorization flaw in Coder, an open-source platform that provisions remote development environments via Terraform. The vulnerability affects the subdomain-based workspace app proxy, where the same-owner Cross-Origin Resource Sharing (CORS) check can be bypassed. When the workspace-name subdomain segment parses as a UUID, Coder resolves the workspace by ID without confirming that the URL's username matches the actual owner. The CORS middleware then trusts the unverified username in the hostname, allowing an attacker to impersonate ownership context. The issue is tracked under [CWE-346] Origin Validation Error.

Critical Impact
An authenticated victim who visits an attacker-crafted app URL on a Coder deployment with wildcard subdomain routing can leak confidential workspace data through bypassed same-owner CORS enforcement.

Affected Products

Coder versions prior to 2.29.17
Coder 2.30.x, 2.31.x, and 2.32.x prior to 2.32.7
Coder 2.33.x prior to 2.33.8 and 2.34.x prior to 2.34.2

Discovery Timeline

2026-07-08 - CVE-2026-55438 published to the National Vulnerability Database (NVD)
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-55438

Vulnerability Analysis

Coder exposes workspace applications through per-workspace subdomains, typically formatted as app--workspace--username.coder.example.com. The proxy layer normally uses the username portion to enforce a same-owner CORS policy, which restricts cross-origin requests to apps owned by the same user. The vulnerability arises because two independent components disagree on the source of truth for workspace ownership.

When the workspace segment parses as a Universally Unique Identifier (UUID), the resolver short-circuits the lookup and returns the workspace by ID. This path skips the check that the username in the hostname belongs to the workspace's real owner. Meanwhile, the CORS middleware continues to trust the username string embedded in the hostname to make its same-owner decision. An attacker who owns any workspace can craft a hostname containing the target workspace's UUID together with the victim's username.

Root Cause

The root cause is inconsistent origin validation across the request pipeline. The workspace resolver authenticates on UUID, while the CORS middleware authorizes on the hostname's username string. Because these values are never cross-checked, the middleware grants same-owner privileges based on attacker-controlled hostname content.

Attack Vector

Exploitation requires that the Coder deployment has subdomain app routing enabled with a wildcard hostname, and that the victim is authenticated when they visit the crafted URL. The attacker sends a phishing link pointing at a subdomain where the workspace segment is the UUID of a workspace they control and the username segment is the victim's username. The victim's browser treats the request as same-owner, and the proxy serves cross-origin responses that the attacker's app can read, exposing session-bound workspace data.

No verified proof-of-concept code has been published. The GitHub security advisory GHSA-5wg6-jmq2-53pw describes the mechanism in detail.

Detection Methods for CVE-2026-55438

Indicators of Compromise

Proxy access logs containing workspace subdomain segments that parse as valid UUIDs rather than human-readable workspace names.
Requests where the hostname's username segment does not match the authenticated owner of the resolved workspace ID.
Unexpected cross-origin requests from external referrers targeting /api or app endpoints under wildcard workspace subdomains.

Detection Strategies

Parse Coder access logs and correlate the hostname's workspace segment against the workspace's real owner from the Coder database. Any mismatch is suspicious.
Alert on inbound requests whose Origin or Referer header points to a Coder subdomain different from the resolved workspace's canonical owner subdomain.
Baseline normal user-to-workspace access patterns and flag workspace lookups performed by UUID from browser sessions rather than API clients.

Monitoring Recommendations

Enable verbose proxy logging on the Coder wildcard hostname and forward logs to a Security Information and Event Management (SIEM) platform for retention and correlation.
Monitor for phishing indicators such as newly registered lookalike domains or shortened URLs that redirect to Coder workspace subdomains.
Track version telemetry across Coder deployments to confirm every instance is running a patched release.

How to Mitigate CVE-2026-55438

Immediate Actions Required

Upgrade Coder to version 2.29.17, 2.32.7, 2.33.8, or 2.34.2 depending on the deployed release branch.
Inventory all Coder deployments and identify any instance running wildcard subdomain app routing, which is the prerequisite for exploitation.
Rotate any workspace-bound credentials or session tokens that may have been exposed to unauthenticated cross-origin access before the upgrade.

Patch Information

The upstream fix validates the subdomain username against the resolved workspace's actual owner and bases the same-owner CORS decision on the authoritative owner identity. Patches are available in the following releases: v2.29.17, v2.32.7, v2.33.8, and v2.34.2. The code changes are published in Pull Request #26085 and Pull Request #26086.

Workarounds

No workarounds are available according to the vendor advisory. Administrators must apply the patched releases to remediate the vulnerability.
Where immediate upgrade is not possible, restrict access to the Coder deployment behind a Virtual Private Network (VPN) or identity-aware proxy to reduce the phishing attack surface until patching completes.

bash

# Example upgrade for a Coder deployment on the 2.34.x branch
coder server --version
# Verify current version, then upgrade the binary or container image
docker pull ghcr.io/coder/coder:v2.34.2
docker compose up -d
coder server --version  # Confirm 2.34.2 is running