CVE-2026-55432: Coder's sub-agent app registration bypasses template port-sharing policy enforcement
Summary
The CreateSubAgent RPC did not validate a requested app sharing level against the template's MaxPortSharingLevel before persisting workspace apps, letting a workspace owner exceed the administrator's configured maximum.
Note: Exploitation requires the ability to register sub-agent apps in a workspace the attacker controls.
Impact
A workspace owner with an agent token could register a sub-agent app as PUBLIC even when the template's MaxPortSharingLevel was owner, exposing the app to unauthenticated users via the wildcard app domain. This affected only deployments using Enterprise port-sharing policy and wildcard app hostnames and required an authenticated workspace owner with an agent token.
Patches
The fix clamps the sub-agent app sharing level to the template's MaxPortSharingLevel.
The fix was backported to all supported release lines:
| Release line | Patched version | |---|---| | 2.34 | v2.34.2 | | 2.33 | v2.33.8 | | 2.32 | v2.32.7 | | 2.29 (ESR) | v2.29.17 |
Workarounds
Disable wildcard app hostnames (CODERWILDCARDACCESSURL) to block subdomain-based app routing.
Resources
- Fix: #26061
Credits
Coder would like to thank Anthropic's Security Team (ANT-2026-22452) for independently disclosing this issue!
Other sources
Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, the CreateSubAgent RPC did not validate a requested app sharing level against the template's MaxPortSharingLevel before persisting workspace apps, letting a workspace owner exceed the administrator's configured maximum. Exploitation requires the ability to register sub-agent apps in a workspace the attacker controls. The fix in versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2clamps the sub-agent app sharing level to the template's MaxPortSharingLevel. As a workaround, disable wildcard app hostnames (CODERWILDCARDACCESSURL) to block subdomain-based app routing.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/coder/coder/v2to a version that resolves this vulnerability.Fixed in 2.29.17 - Upgrade
Upgrade
go/github.com/coder/coder/v2to a version that resolves this vulnerability.Fixed in 2.32.7 - Upgrade
Upgrade
go/github.com/coder/coder/v2to a version that resolves this vulnerability.Fixed in 2.33.8 - Upgrade
Upgrade
go/github.com/coder/coder/v2to a version that resolves this vulnerability.Fixed in 2.34.2 - Upgrade
Upgrade
coder/coderto a version that resolves this vulnerability.Fixed in 2.29.17 - Upgrade
Upgrade
coder/coderto a version that resolves this vulnerability.Fixed in 2.32.7 - Upgrade
Upgrade
coder/coderto a version that resolves this vulnerability.Fixed in 2.33.8 - Upgrade
Upgrade
coder/coderto a version that resolves this vulnerability.Fixed in 2.34.2 - Configuration
Disable wildcard app hostnames by disabling CODER_WILDCARD_ACCESS_URL to block subdomain-based app routing.
Coder CODER_WILDCARD_ACCESS_URL = disabled
Event History
Frequently Asked Questions
What is the severity of CVE-2026-55432?
The severity of CVE-2026-55432 is medium with a score of 5.4.
How do I fix CVE-2026-55432?
To fix CVE-2026-55432, ensure that the app sharing level is validated against the template's MaxPortSharingLevel before persisting any workspace apps.
What software is affected by CVE-2026-55432?
CVE-2026-55432 affects the Coder Coder Go software available at go/github.com/coder/coder/v2.
What does CVE-2026-55432 exploit?
CVE-2026-55432 exploits a bypass in the app registration process that allows a workspace owner to exceed the maximum port sharing level set by administrators.
What type of vulnerability is CVE-2026-55432?
CVE-2026-55432 is a security vulnerability related to app registration process management.