CVE-2026-55433: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers
Summary
The devcontainer recreate endpoint relied on route middleware that checked only ActionRead on the workspace and, unlike the sibling delete endpoint, performed no ActionUpdate check before triggering the destructive rebuild.
Note: Exploitation requires an existing low-privilege role with access to the target workspace.
Impact
Any authenticated principal with read-only workspace access, such as a Template Admin or Org Template Admin, could recreate a devcontainer, destroying uncommitted in-container state and, if called repeatedly, denying service. This is an authorization bypass leading to data loss and denial of service.
Patches
The fix adds an explicit ActionUpdate authorization check before the agent is dialed like the delete endpoint.
The fix was backported to all supported release lines:
| Release line | Patched version | |---|---| | 2.34 | v2.34.2 | | 2.33 | v2.33.8 | | 2.32 | v2.32.7 | | 2.29 (ESR) | v2.29.17 |
Workarounds
None.
Resources
- Fix: #25812
Credits
Coder would like to thank Anthropic's Security Team (ANT-2026-22454) for independently disclosing this issue!
Other sources
Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, the devcontainer recreate endpoint relied on route middleware that checked only ActionRead on the workspace and, unlike the sibling delete endpoint, performed no ActionUpdate check before triggering the destructive rebuild. Exploitation requires an existing low-privilege role with access to the target workspace. The fix in versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2 adds an explicit ActionUpdate authorization check before the agent is dialed like the delete endpoint. No known workarounds are available.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/coder/coder/v2to a version that resolves this vulnerability.Fixed in 2.29.17 - Upgrade
Upgrade
go/github.com/coder/coder/v2to a version that resolves this vulnerability.Fixed in 2.32.7 - Upgrade
Upgrade
go/github.com/coder/coder/v2to a version that resolves this vulnerability.Fixed in 2.33.8 - Upgrade
Upgrade
go/github.com/coder/coder/v2to a version that resolves this vulnerability.Fixed in 2.34.2 - Upgrade
Upgrade
Coder devcontainer recreate endpointto a version that resolves this vulnerability.Fixed in 2.29.17 - Upgrade
Upgrade
Coder devcontainer recreate endpointto a version that resolves this vulnerability.Fixed in 2.32.7 - Upgrade
Upgrade
Coder devcontainer recreate endpointto a version that resolves this vulnerability.Fixed in 2.33.8 - Upgrade
Upgrade
Coder devcontainer recreate endpointto a version that resolves this vulnerability.Fixed in 2.34.2
Event History
Frequently Asked Questions
What is the severity of CVE-2026-55433?
The severity of CVE-2026-55433 is medium with a score of 5.4.
How do I fix CVE-2026-55433?
To fix CVE-2026-55433, ensure proper authorization checks are implemented for the devcontainer recreate endpoint before performing any destructive actions.
What kind of roles are affected by CVE-2026-55433?
CVE-2026-55433 affects read-only roles that erroneously have access to destroy containers.
What is the potential impact of exploiting CVE-2026-55433?
Exploitation of CVE-2026-55433 may allow low-privilege users to destroy containers unexpectedly.
Which software is vulnerable to CVE-2026-55433?
CVE-2026-55433 affects the Coder software, specifically the Go module found at go/github.com/coder/coder/v2.