
Cloud Vulnerability DB
A community-led vulnerabilities database
CVE-2026-55438 is an origin validation error (CWE-346) in Coder's subdomain-based workspace app proxy that allows an authenticated attacker to bypass the same-owner CORS check via UUID-based subdomain spoofing. The vulnerability affects Coder versions prior to 2.29.17, 2.32.7 (for the 2.30.x–2.32.x range), 2.33.8, and 2.34.2. It was disclosed on July 6, 2026 via GitHub Advisory GHSA-5wg6-jmq2-53pw, with patches released on June 11–12, 2026. The CVSS v3.1 base score is 6.8 (Medium) per NVD, or 5.8 (Moderate) per the GitHub advisory (GitHub Advisory, Feedly).
The root cause (CWE-346: Origin Validation Error) lies in how Coder's workspace app proxy resolves workspaces and performs CORS checks. When a subdomain's workspace-name segment is a valid UUID, the server resolves the workspace by ID rather than by name — but critically, it never verifies that the username embedded in the subdomain hostname matches the actual owner of that workspace. The CORS middleware then trusts the unverified username from the hostname when performing its same-owner check, making the check trivially bypassable. An attacker can craft a subdomain URL encoding their own workspace's UUID alongside a victim's username (e.g., <victim-username>--<attacker-workspace-uuid>--<app>.coder.example.com), causing the CORS middleware to grant same-owner privileges to the attacker's origin. Exploitation requires subdomain app routing (wildcard hostname) to be enabled on the Coder deployment and social engineering to lure an authenticated victim to the crafted URL (GitHub Advisory, Fix PR #26085).
A successful exploit allows an authenticated attacker's JavaScript, running in the victim's authenticated browser session, to issue credentialed cross-origin fetch() requests to the victim's workspace apps and read the responses. This results in a high confidentiality impact — sensitive data accessible through the victim's workspace apps (e.g., development secrets, source code, internal services) can be exfiltrated to the attacker. There is no integrity or availability impact; the vulnerability is scoped to data exposure across workspace ownership boundaries within the same Coder deployment (GitHub Advisory, Feedly).
https://<victim-username>--<attacker-workspace-uuid>--<app-slug>.<coder-wildcard-domain>/. The server resolves the workspace by UUID (your workspace) but the CORS middleware reads the victim's username from the hostname.fetch() requests (with credentials: 'include') to the victim's workspace app endpoints.OPTIONS) requests from unexpected origins against workspace app endpoints.Upgrade Coder to one of the patched versions: 2.29.17 (ESR), 2.32.7, 2.33.8, or 2.34.2, depending on the currently deployed release line. The fix validates the subdomain username against the resolved workspace's actual owner and rejects mismatched requests with HTTP 404. No configuration-based workarounds are available; however, organizations that do not require subdomain app routing can reduce their attack surface by disabling the wildcard hostname feature. Coder strongly recommends upgrading immediately, as these releases also address multiple other security vulnerabilities disclosed under the same coordinated disclosure program (GitHub Advisory, v2.29.17 Release, v2.32.7 Release).
The vulnerability was responsibly disclosed by Anthropic's Security Team (Project Glasswing, reference ANT-2026-22434) under a coordinated vulnerability disclosure program, and Coder publicly credited them in the advisory and release notes. The fix was developed internally by Coder contributor geokat and reviewed by the Coder security team. No significant broader media coverage or notable independent researcher commentary beyond the GitHub advisory and pull request discussions has been observed (GitHub Advisory, v2.29.17 Release).
Source: This report was generated using AI
Free Vulnerability Assessment
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
"Best User Experience I have ever seen, provides full visibility to cloud workloads."
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
"We know that if Wiz identifies something as critical, it actually is."