CVE-2026-55438

Name of the Vulnerable Software and Affected Versions Coder versions prior to 2.29.17 Coder versions prior to 2.32.7 Coder versions prior to 2.33.8 Coder versions prior to 2.34.2

Description The subdomain-based workspace app proxy allows a bypass of the same-owner Cross-Origin Resource Sharing (CORS) check. This occurs when a workspace-name subdomain segment is parsed as a UUID, causing the workspace to be resolved by ID without verifying if the username in the URL matches the actual owner. Simultaneously, the CORS middleware trusts the unverified username provided in the hostname. An authenticated attacker can craft a subdomain containing their own workspace UUID and a victim's username to issue credentialed cross-origin fetch() requests to the victim's workspace apps and exfiltrate accessible data. Successful exploitation requires subdomain app routing (wildcard hostname) to be enabled and a victim to visit the crafted URL while authenticated.

Recommendations Update to version 2.29.17 or later. Update to version 2.32.7 or later. Update to version 2.33.8 or later. Update to version 2.34.2 or later.