CVE-2026-55430 Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access
Attackers can access other users' workspace apps by spoofing the X-Forwarded-Host header in subdomain routing configurations.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-55430?
CVE-2026-55430 is a medium-severity missing authorization vulnerability in coder, published on 8 Jul 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, the workspace app proxy resolves the target app from `httpapi.RequestHost()` which prefers the `X-Forwarded-Host` header over the real `Host` header. No middleware strips `X-Forwarded-Host` before routing and the header is not browser-forbidden so client-side JavaScript can set it on `fetch()` calls. Practical exploitation requires subdomain app routing (wildcard hostname) enabled, a victim who visits the attacker's shared app and a deployment whose upstream proxy does not strip `X-Forwarded-Host`. The fix in versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2 trusts `X-Forwarded-Host` only from configured trusted proxies and otherwise resolves the routing host from the verified request host. As a workaround, place an upstream reverse proxy that strips or overwrites `X-Forwarded-Host` on untrusted requests.
Which versions are affected by CVE-2026-55430?
10 open source packages ship an affected version, including github.com/coder/coder/v2 and github.com/coder/coder. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/coder/coder/v2 Go | All versions | 2.29.17, 2.32.7, 2.33.8, 2.34.2 |
github.com/coder/coder/v2 Go | All versions | 2.29.17 |
github.com/coder/coder/v2 Go | All versions | 2.29.17 |
github.com/coder/coder/v2 Go | From 2.30.0 | 2.32.7 |
github.com/coder/coder/v2 Go | From 2.30.0 | 2.32.7 |
github.com/coder/coder/v2 Go | From 2.33.0 | 2.33.8 |
4 more packages
github.com/coder/coder/v2 Go | From 2.33.0 | 2.33.8 |
github.com/coder/coder/v2 Go | From 2.34.0 | 2.34.2 |
github.com/coder/coder/v2 Go | From 2.34.0 | 2.34.2 |
github.com/coder/coder Go | All versions | None |
Products include Coder Coder.
How do I fix CVE-2026-55430?
Upgrade github.com/coder/coder/v2 to a fixed version for your release line: 2.29.17, 2.32.7, 2.33.8 or 2.34.2.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-55430 being exploited?
There is no known exploitation of CVE-2026-55430 in the wild and no public exploit code.
Other vulnerabilities in coder
- CVE-2026-46354 Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft
- CVE-2026-55429 Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID
- CVE-2026-55427 Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh`
- CVE-2026-55428 Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator
- CVE-2024-27918 Coder's OIDC authentication allows email with partially matching domain to register
Sources
Also known as GHSA-5g4w-3vw9-478w, GO-2026-5917.