CVE-2026-55438: 
NixOS vulnerability analysis and mitigation

CVE-2026-55438 is an origin validation error (CWE-346) in Coder's subdomain-based workspace app proxy that allows an authenticated attacker to bypass the same-owner CORS check via UUID-based subdomain spoofing. The vulnerability affects Coder versions prior to 2.29.17, 2.32.7 (for the 2.30.x–2.32.x range), 2.33.8, and 2.34.2. It was disclosed on July 6, 2026 via GitHub Advisory GHSA-5wg6-jmq2-53pw, with patches released on June 11–12, 2026. The CVSS v3.1 base score is 6.8 (Medium) per NVD, or 5.8 (Moderate) per the GitHub advisory (GitHub Advisory, Feedly).

The root cause (CWE-346: Origin Validation Error) lies in how Coder's workspace app proxy resolves workspaces and performs CORS checks. When a subdomain's workspace-name segment is a valid UUID, the server resolves the workspace by ID rather than by name — but critically, it never verifies that the username embedded in the subdomain hostname matches the actual owner of that workspace. The CORS middleware then trusts the unverified username from the hostname when performing its same-owner check, making the check trivially bypassable. An attacker can craft a subdomain URL encoding their own workspace's UUID alongside a victim's username (e.g., <victim-username>--<attacker-workspace-uuid>--<app>.coder.example.com), causing the CORS middleware to grant same-owner privileges to the attacker's origin. Exploitation requires subdomain app routing (wildcard hostname) to be enabled on the Coder deployment and social engineering to lure an authenticated victim to the crafted URL (GitHub Advisory, Fix PR #26085).

A successful exploit allows an authenticated attacker's JavaScript, running in the victim's authenticated browser session, to issue credentialed cross-origin fetch() requests to the victim's workspace apps and read the responses. This results in a high confidentiality impact — sensitive data accessible through the victim's workspace apps (e.g., development secrets, source code, internal services) can be exfiltrated to the attacker. There is no integrity or availability impact; the vulnerability is scoped to data exposure across workspace ownership boundaries within the same Coder deployment (GitHub Advisory, Feedly).

1. Reconnaissance: Identify a Coder deployment with subdomain app routing (wildcard hostname) enabled. Confirm the target has a victim user whose workspace data is of interest.
2. Obtain workspace UUID: As an authenticated attacker, create or identify your own workspace and note its UUID (available via the Coder API or UI).
3. Craft malicious subdomain URL: Construct a workspace app URL embedding the victim's username and your own workspace's UUID in the subdomain, e.g., https://<victim-username>--<attacker-workspace-uuid>--<app-slug>.<coder-wildcard-domain>/. The server resolves the workspace by UUID (your workspace) but the CORS middleware reads the victim's username from the hostname.
4. Host malicious JavaScript: Serve a page from your crafted app URL that issues credentialed fetch() requests (with credentials: 'include') to the victim's workspace app endpoints.
5. Social engineer the victim: Trick the authenticated victim into visiting your crafted app URL (e.g., via phishing or a shared link).
6. Exfiltrate data: The victim's browser, trusting the CORS same-owner check (which incorrectly passes), sends authenticated requests to the victim's workspace apps; responses are readable by your JavaScript and can be exfiltrated to an attacker-controlled server (GitHub Advisory, Fix PR #26085).

• Network: Unusual cross-origin requests from a Coder workspace app subdomain where the username segment does not match the workspace owner; outbound data transfers from a victim's browser session to unexpected external endpoints.
• Logs: Coder server access logs showing requests to workspace app subdomains where the username in the hostname does not correspond to the resolved workspace's owner (prior to patching, these would succeed with HTTP 200 rather than 404); CORS preflight (OPTIONS) requests from unexpected origins against workspace app endpoints.
• Application Behavior: Workspace app requests originating from a subdomain hostname containing a UUID-formatted workspace-name segment combined with a username that does not own that workspace — a pattern that patched versions now reject with HTTP 404 (Fix PR #26085, GitHub Advisory).

Upgrade Coder to one of the patched versions: 2.29.17 (ESR), 2.32.7, 2.33.8, or 2.34.2, depending on the currently deployed release line. The fix validates the subdomain username against the resolved workspace's actual owner and rejects mismatched requests with HTTP 404. No configuration-based workarounds are available; however, organizations that do not require subdomain app routing can reduce their attack surface by disabling the wildcard hostname feature. Coder strongly recommends upgrading immediately, as these releases also address multiple other security vulnerabilities disclosed under the same coordinated disclosure program (GitHub Advisory, v2.29.17 Release, v2.32.7 Release).

The vulnerability was responsibly disclosed by Anthropic's Security Team (Project Glasswing, reference ANT-2026-22434) under a coordinated vulnerability disclosure program, and Coder publicly credited them in the advisory and release notes. The fix was developed internally by Coder contributor geokat and reviewed by the Coder security team. No significant broader media coverage or notable independent researcher commentary beyond the GitHub advisory and pull request discussions has been observed (GitHub Advisory, v2.29.17 Release).