GHSA-5wg6-jmq2-53pw CVE-2026-55438 GO-2026-5918
Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing
- Severity
- 5.8 / 10
- Medium · CVSS 3.1
- Exploit chance (EPSS)
- 0.22%
- Chance of exploitation in the next 30 days. Higher than 12.87% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-346 Origin Validation Error
- Fix
2.34.2- Upgrade github.com/coder/coder/v2 to this version or later
Description
Summary
Coder's subdomain-based workspace app proxy allowed the same-owner CORS check to be bypassed. When a workspace-name subdomain segment parsed as a UUID, the workspace was resolved by ID without confirming the URL's username matched the real owner, while the CORS middleware trusted the unverified username in the hostname.
Note: Practical exploitation requires subdomain app routing (wildcard hostname) enabled and a victim who visits the attacker's crafted app URL while authenticated.
Impact
An authenticated user could craft a subdomain encoding their own workspace UUID and a victim's username. If the victim visited the attacker's URL, the attacker's JavaScript could issue credentialed cross-origin fetch() requests to the victim's workspace apps and read the responses, exfiltrating data accessible through those apps.
Patches
The fix validates the subdomain username against the resolved workspace's actual owner and bases the same-owner CORS decision on the authoritative owner identity.
The fix was backported to all supported release lines:
| Release line | Patched version |
|---|---|
| 2.34 | v2.34.2 |
| 2.33 | v2.33.8 |
| 2.32 | v2.32.7 |
| 2.29 (ESR) | v2.29.17 |
Workarounds
None.
Resources
- Fix: #26086, #26085
Credits
Coder would like to thank Anthropic's Security Team (ANT-2026-22434) for independently disclosing this issue!
Affected versions
Go
| Package | Vulnerable | Fixed in |
|---|---|---|
| github.com/coder/coder | all versions |
No fix yet |
| github.com/coder/coder/v2 | >= 2.34.0, < 2.34.2 |
2.34.2 |
| github.com/coder/coder/v2 | >= 2.33.0, < 2.33.8 |
2.33.8 |
| github.com/coder/coder/v2 | >= 2.30.0, < 2.32.7 |
2.32.7 |
| github.com/coder/coder/v2 | < 2.29.17 |
2.29.17 |
| github.com/coder/coder/v2 | < 2.29.17>= 2.30.0, < 2.32.7>= 2.33.0, < 2.33.8>= 2.34.0, < 2.34.2 |
2.29.172.32.72.33.82.34.2 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
github.com/coder/coder/v2 Go → 2.34.2
- go
go get github.com/coder/coder/v2@v2.34.2 && go mod tidy
Severity breakdown
CVSS 3.1 5.8
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N
- Attack vector
- Network
- Attack complexity
- High
- Privileges required
- Low
- User interaction
- Required
- Scope
- Changed
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Weakness
CWE-346: Origin Validation Error
The product does not properly verify that the source of data or communication is valid.
References
Packages
Other links
- github.com/coder/coder/security/advisories/GHSA-5wg6-jmq2-53pw
- github.com/coder/coder/pull/26085
- github.com/coder/coder/pull/26086
- github.com/coder/coder/releases/tag/v2.29.17
- github.com/coder/coder/releases/tag/v2.32.7
- github.com/coder/coder/releases/tag/v2.33.8
- github.com/coder/coder/releases/tag/v2.34.2
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-h58c-xccx-75m3 Coder: Stored HTML injection via unescaped ApplicationName and LogoURL appearance settings | Medium | Also affects github.com/coder/coder |
| GHSA-8fxq-53rx-ph5f Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison | Medium | Also affects github.com/coder/coder |
| GHSA-qrwj-vh9x-gw5v Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write | High | Also affects github.com/coder/coder |
| GHSA-7qw2-f75v-62f7 Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine component | Medium | Also affects github.com/coder/coder |
| GHSA-84rm-42xw-mx52 Coder's AI Bridge Proxy skips TLS certificate verification in default configuration | High | Also affects github.com/coder/coder |
| GHSA-wqxv-w64v-5wh6 Suspended Coder users retain access to AI Bridge LLM proxy endpoints | Medium | Also affects github.com/coder/coder |
| GHSA-f5vp-w269-392g Coder vulnerable to denial of service via unbounded request body in AI Bridge provider endpoints | Medium | Also affects github.com/coder/coder |
| GHSA-jqj2-x4c5-jfxm Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers | Medium | Also affects github.com/coder/coder |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor