GHSA-5g4w-3vw9-478w CVE-2026-55430 GO-2026-5917
Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access
- Severity
- 5.8 / 10
- Medium · CVSS 3.1
- Exploit chance (EPSS)
- 0.21%
- Chance of exploitation in the next 30 days. Higher than 10.97% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-345 Insufficient Verification of Data Authenticity
- CWE-441 Unintended Proxy or Intermediary ('Confused Deputy')
- Fix
2.34.2- Upgrade github.com/coder/coder/v2 to this version or later
Description
Summary
The workspace app proxy resolves the target app from httpapi.RequestHost() which prefers the X-Forwarded-Host header over the real Host header. No middleware strips X-Forwarded-Host before routing and the header is not browser-forbidden so client-side JavaScript can set it on fetch() calls.
Note: Practical exploitation requires subdomain app routing (wildcard hostname) enabled, a victim who visits the attacker's shared app and a deployment whose upstream proxy does not strip
X-Forwarded-Host.
Impact
App session cookies are scoped to the wildcard parent domain so the browser attaches them to any app subdomain. An attacker who controls a shared workspace app can serve JavaScript that sends same-site requests with a forged X-Forwarded-Host pointing at a victim's private app. The server routes by the attacker-controlled header but authorizes with the victim's cookie which lets the attacker read the victim's private app responses. Subdomain app routing must be enabled and no upstream proxy may strip X-Forwarded-Host.
Patches
The fix trusts X-Forwarded-Host only from configured trusted proxies and otherwise resolves the routing host from the verified request host.
The fix was backported to all supported release lines:
| Release line | Patched version |
|---|---|
| 2.34 | v2.34.2 |
| 2.33 | v2.33.8 |
| 2.32 | v2.32.7 |
| 2.29 (ESR) | v2.29.17 |
Workarounds
Place an upstream reverse proxy that strips or overwrites X-Forwarded-Host on untrusted requests.
Resources
- Fix: #26204
Credits
Coder would like to thank Anthropic's Security Team (ANT-2026-22435) for independently disclosing this issue!
Affected versions
Go
| Package | Vulnerable | Fixed in |
|---|---|---|
| github.com/coder/coder | all versions |
No fix yet |
| github.com/coder/coder/v2 | >= 2.34.0, < 2.34.2 |
2.34.2 |
| github.com/coder/coder/v2 | >= 2.33.0, < 2.33.8 |
2.33.8 |
| github.com/coder/coder/v2 | >= 2.30.0, < 2.32.7 |
2.32.7 |
| github.com/coder/coder/v2 | < 2.29.17 |
2.29.17 |
| github.com/coder/coder/v2 | < 2.29.17>= 2.30.0, < 2.32.7>= 2.33.0, < 2.33.8>= 2.34.0, < 2.34.2 |
2.29.172.32.72.33.82.34.2 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
github.com/coder/coder/v2 Go → 2.34.2
- go
go get github.com/coder/coder/v2@v2.34.2 && go mod tidy
Severity breakdown
CVSS 3.1 5.8
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N
- Attack vector
- Network
- Attack complexity
- High
- Privileges required
- Low
- User interaction
- Required
- Scope
- Changed
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Weakness
CWE-345: Insufficient Verification of Data Authenticity
The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.
CWE-441: Unintended Proxy or Intermediary ('Confused Deputy')
The product receives a request, message, or directive from an upstream component, but the product does not sufficiently preserve the original source of the request before forwarding the request to an external actor that is outside of the product's control sphere. This causes the product to appear to be the source of the request, leading it to act as a proxy or other intermediary between the upstream component and the external actor.
How to prevent it
- Architecture and Design: Enforce the use of strong mutual authentication mechanism between the two parties.
- Architecture and Design: Whenever a product is an intermediary or proxy for transactions between two other components, the proxy core should not drop the identity of the initiator of the transaction. The immutability of the identity of the initiator must be maintained and should be forwarded all the way to the target.
References
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-h58c-xccx-75m3 Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings | Medium | Also affects github.com/coder/coder |
| GHSA-8fxq-53rx-ph5f Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison | Medium | Also affects github.com/coder/coder |
| GHSA-qrwj-vh9x-gw5v Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write | High | Also affects github.com/coder/coder |
| GHSA-5wg6-jmq2-53pw Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing | Medium | Also affects github.com/coder/coder |
| GHSA-7qw2-f75v-62f7 Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component | Medium | Also affects github.com/coder/coder |
| GHSA-84rm-42xw-mx52 Coder's AI Bridge Proxy skips TLS certificate verification in default configuration | High | Also affects github.com/coder/coder |
| GHSA-wqxv-w64v-5wh6 Suspended Coder users retain access to AI Bridge LLM proxy endpoints | Medium | Also affects github.com/coder/coder |
| GHSA-f5vp-w269-392g Coder vulnerable to denial of service via unbounded request body in AI Bridge provider endpoints | Medium | Also affects github.com/coder/coder |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor