
Cloud Vulnerability DB
A community-led vulnerabilities database
CVE-2026-55438 is an origin validation error (CWE-346) in Coder's subdomain-based workspace app proxy that allows an authenticated attacker to bypass the same-owner CORS check via UUID-based subdomain spoofing. The vulnerability affects Coder versions prior to 2.29.17, 2.32.7 (for the 2.30.x–2.32.x range), 2.33.8, and 2.34.2. It was disclosed on June 12, 2026 via a GitHub Security Advisory and assigned CVE-2026-55438 on July 6, 2026. The CVSS v3.1 base score is 5.8 (Medium), reflecting network-based attack vector with required user interaction and high confidentiality impact (GitHub Advisory).
The root cause (CWE-346: Origin Validation Error) lies in how Coder's workspace app proxy resolves workspaces and enforces CORS. When a subdomain's workspace-name segment is a valid UUID, the server resolves the workspace by ID rather than by name — but critically, it never verifies that the username embedded in the subdomain hostname matches the actual owner of that workspace. The CORS middleware then trusts the unverified username from the hostname to make its same-owner access decision, allowing an attacker to craft a subdomain that encodes their own workspace UUID alongside a victim's username. Exploitation requires: (1) subdomain app routing with wildcard hostname enabled on the Coder deployment, (2) the attacker holding a valid Coder account, and (3) a victim who is authenticated and visits the attacker's crafted URL. The fix (PR #26085) rejects requests with a 404 when the resolved workspace owner does not match the username in the URL (GitHub Advisory, Fix PR #26085).
Successful exploitation allows an authenticated attacker's JavaScript — served from a crafted subdomain URL — to issue credentialed cross-origin fetch() requests to a victim's workspace apps and read the responses within the victim's authenticated browser session. This results in a high confidentiality impact: sensitive data accessible through the victim's workspace apps (e.g., development secrets, application data, internal services) can be exfiltrated to the attacker. There is no integrity or availability impact, and exploitation does not directly enable lateral movement beyond data readable through the victim's workspace app endpoints (GitHub Advisory).
550e8400-e29b-41d4-a716-446655440000).https://<appname>--<agent>--<your-workspace-uuid>--<victim-username>.<coder-wildcard-domain>/.fetch() requests (with credentials: 'include') to the victim's workspace app endpoints.fetch() requests (with Origin header) to workspace app endpoints originating from unexpected subdomains.Access-Control-Allow-Origin) on workspace app endpoints.Coder has released patched versions across all supported release lines: v2.29.17 (ESR), v2.32.7 (for 2.30.x–2.32.x), v2.33.8, and v2.34.2. Organizations should upgrade to the appropriate patched version immediately. No configuration-based workarounds are available; however, if subdomain app routing (wildcard hostname) is not required for your deployment, disabling this feature eliminates the attack surface entirely. The fix validates the subdomain username against the resolved workspace's actual owner before processing CORS decisions (GitHub Advisory, Release v2.29.17, Release v2.32.7).
Coder credited Anthropic's Security Team (Project Glasswing, ANT-2026-22434) for independently and responsibly disclosing this vulnerability under a coordinated disclosure program, and released security hardening patches across all supported release lines simultaneously. The releases were labeled [SECURITY] and accompanied by a strong recommendation to upgrade. No notable independent researcher commentary or significant social media discussion beyond standard CVE tracking feeds has been observed (Release v2.29.17, Release v2.32.7).
Source: This report was generated using AI
Free Vulnerability Assessment
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
"Best User Experience I have ever seen, provides full visibility to cloud workloads."
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
"We know that if Wiz identifies something as critical, it actually is."