CVE-2026-55438: 
NixOS vulnerability analysis and mitigation

CVE-2026-55438 is an origin validation error (CWE-346) in Coder's subdomain-based workspace app proxy that allows an authenticated attacker to bypass the same-owner CORS check via UUID-based subdomain spoofing. The vulnerability affects Coder versions prior to 2.29.17, 2.32.7 (for the 2.30.x–2.32.x range), 2.33.8, and 2.34.2. It was disclosed on June 12, 2026 via a GitHub Security Advisory and assigned CVE-2026-55438 on July 6, 2026. The CVSS v3.1 base score is 5.8 (Medium), reflecting network-based attack vector with required user interaction and high confidentiality impact (GitHub Advisory).

The root cause (CWE-346: Origin Validation Error) lies in how Coder's workspace app proxy resolves workspaces and enforces CORS. When a subdomain's workspace-name segment is a valid UUID, the server resolves the workspace by ID rather than by name — but critically, it never verifies that the username embedded in the subdomain hostname matches the actual owner of that workspace. The CORS middleware then trusts the unverified username from the hostname to make its same-owner access decision, allowing an attacker to craft a subdomain that encodes their own workspace UUID alongside a victim's username. Exploitation requires: (1) subdomain app routing with wildcard hostname enabled on the Coder deployment, (2) the attacker holding a valid Coder account, and (3) a victim who is authenticated and visits the attacker's crafted URL. The fix (PR #26085) rejects requests with a 404 when the resolved workspace owner does not match the username in the URL (GitHub Advisory, Fix PR #26085).

Successful exploitation allows an authenticated attacker's JavaScript — served from a crafted subdomain URL — to issue credentialed cross-origin fetch() requests to a victim's workspace apps and read the responses within the victim's authenticated browser session. This results in a high confidentiality impact: sensitive data accessible through the victim's workspace apps (e.g., development secrets, application data, internal services) can be exfiltrated to the attacker. There is no integrity or availability impact, and exploitation does not directly enable lateral movement beyond data readable through the victim's workspace app endpoints (GitHub Advisory).

1. Reconnaissance: Identify a Coder deployment with subdomain app routing (wildcard hostname) enabled. Confirm the target victim's Coder username and that they have active workspace apps.
2. Obtain workspace UUID: As an authenticated attacker, create or identify your own workspace and note its UUID (e.g., 550e8400-e29b-41d4-a716-446655440000).
3. Craft malicious subdomain URL: Construct a workspace app URL where the workspace-name segment is your own workspace's UUID but the username segment is the victim's username — e.g., https://<appname>--<agent>--<your-workspace-uuid>--<victim-username>.<coder-wildcard-domain>/.
4. Host malicious JavaScript: Serve JavaScript from your workspace app that issues credentialed fetch() requests (with credentials: 'include') to the victim's workspace app endpoints.
5. Social engineer the victim: Trick the authenticated victim into visiting the crafted URL (e.g., via phishing, shared link, or embedded content).
6. Exfiltrate data: The CORS middleware, trusting the unverified victim username in the hostname, permits the credentialed cross-origin read; the attacker's JavaScript receives and exfiltrates the victim's workspace app responses (GitHub Advisory, Fix PR #26085).

• Network: Unusual cross-origin requests from a Coder workspace app subdomain where the username segment does not match the workspace owner; credentialed fetch() requests (with Origin header) to workspace app endpoints originating from unexpected subdomains.
• Logs: Coder server access logs showing requests to workspace app URLs where the subdomain username does not correspond to the resolved workspace owner (prior to patching, these would succeed with a 200; after patching, they return 404); repeated access to workspace app endpoints from a single session with mismatched subdomain usernames.
• Application Behavior: Workspace app responses being served to origins that do not match the workspace owner's subdomain, observable in CORS-related HTTP response headers (Access-Control-Allow-Origin) on workspace app endpoints.

Coder has released patched versions across all supported release lines: v2.29.17 (ESR), v2.32.7 (for 2.30.x–2.32.x), v2.33.8, and v2.34.2. Organizations should upgrade to the appropriate patched version immediately. No configuration-based workarounds are available; however, if subdomain app routing (wildcard hostname) is not required for your deployment, disabling this feature eliminates the attack surface entirely. The fix validates the subdomain username against the resolved workspace's actual owner before processing CORS decisions (GitHub Advisory, Release v2.29.17, Release v2.32.7).

Coder credited Anthropic's Security Team (Project Glasswing, ANT-2026-22434) for independently and responsibly disclosing this vulnerability under a coordinated disclosure program, and released security hardening patches across all supported release lines simultaneously. The releases were labeled [SECURITY] and accompanied by a strong recommendation to upgrade. No notable independent researcher commentary or significant social media discussion beyond standard CVE tracking feeds has been observed (Release v2.29.17, Release v2.32.7).