CVE-2026-55433
Coder allows organizations to provision remote development environments via Terraform.
Does this matter?
Lower severity and a low EPSS score (0.39%). Track it; it rarely justifies an emergency change on its own.
Description
Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, the devcontainer recreate endpoint relied on route middleware that checked only `ActionRead` on the workspace and, unlike the sibling delete endpoint, performed no `ActionUpdate` check before triggering the destructive rebuild. Exploitation requires an existing low-privilege role with access to the target workspace. The fix in versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2 adds an explicit `ActionUpdate` authorization check before the agent is dialed like the delete endpoint. No known workarounds are available.
- CVSS 3.1
- 5.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
- EPSS
- 0.39% probability · 33th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-862
- Affected
- coder/coder
- Source
- security-advisories@github.com
References
- https://github.com/coder/coder/pull/25812Issue Tracking, Patch
- https://github.com/coder/coder/releases/tag/v2.29.17Release Notes
- https://github.com/coder/coder/releases/tag/v2.32.7Release Notes
- https://github.com/coder/coder/releases/tag/v2.33.8Release Notes
- https://github.com/coder/coder/releases/tag/v2.34.2Release Notes
- https://github.com/coder/coder/security/advisories/GHSA-jqj2-x4c5-jfxmPatch, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.