EUVD-2026-42135
GHSA-9rjw-3gwp-f59v
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N
Network API reachable (AV:N/AC:L) but attacker must be a template author or provisioner operator (PR:H); rebinding another user's workspace crosses an authz boundary (S:C) yielding traffic interception (C:H/I:H), with no availability loss (A:N).
Primary rating from Vendor (https://github.com/coder/coder).
CVSS VectorVendor: https://github.com/coder/coder
Lifecycle Timeline
1DescriptionCVE.org
Summary
UpsertWorkspaceApp overwrites an existing app's agent_id on a primary-key conflict and insertAgentApp accepts the app ID from the provisioner's CompleteJob payload without verifying it belongs to the workspace being built. CompleteJob runs under dbauthz.AsProvisionerd so the authorization layer does not block the cross-workspace upsert.
> Note: Exploitation requires elevated access as a template author or external provisioner operator.
Impact
A user with template authorship or external provisioner access can submit a CompleteJob payload with a known victim app UUID and an attacker-controlled agent ID. On completion of the attacker's build the victim's app row is rebound to the attacker's agent so later app traffic such as IDE and terminal sessions is proxied to the attacker's workspace. App UUIDs are discoverable through the public API.
Patches
The fix verifies that any existing workspace_apps row matching the supplied ID belongs to the workspace being built and rejects cross-workspace agent reassignment.
The fix was backported to all supported release lines:
Workarounds
None. Upgrading is required.
Resources
- Fix: #26103
Credits
Coder would like to thank Anthropic's Security Team (ANT-2026-22441) for independently disclosing this issue!
AnalysisAI
Cross-workspace agent hijacking in Coder (self-hosted cloud development environment platform) lets a user with template-authorship or external-provisioner privileges rebind another user's workspace app to an attacker-controlled agent. By submitting a crafted CompleteJob payload referencing a known victim app UUID, the attacker causes later app traffic - including IDE and terminal sessions - to be proxied through their own workspace, enabling interception. No public exploit is identified at time of analysis; it is not listed in CISA KEV. Fixed in v2.34.2, v2.33.8, v2.32.7, and v2.29.17.
Technical ContextAI
Coder is an open-source Go platform (pkg:go/github.com/coder/coder/v2) that provisions remote development workspaces, each backed by an agent that proxies IDE, terminal, and port-forwarding traffic. The flaw lives in the provisioner completion path: UpsertWorkspaceApp overwrites an existing app's agent_id on a primary-key conflict, and insertAgentApp trusts the app ID supplied in the provisioner's CompleteJob payload without checking that the row belongs to the workspace being built. Because CompleteJob executes under the dbauthz.AsProvisionerd authorization context, the normal authz layer treats the actor as fully privileged and does not block the cross-workspace write. This maps to CWE-639 (Authorization Bypass Through User-Controlled Key / IDOR): the app UUID is an attacker-controllable key that is not scoped to the requester's tenant, so supplying a victim's UUID reassigns their resource.
RemediationAI
Upgrade to a patched build for your release line: Vendor-released patch v2.34.2, v2.33.8, v2.32.7, or v2.29.17 (2.29 ESR), per the coder/coder advisory GHSA-9rjw-3gwp-f59v and PR #26103, which adds verification that any existing workspace_apps row matching the supplied ID belongs to the workspace being built and rejects cross-workspace agent reassignment. The vendor explicitly states there are no workarounds, so upgrading is required. Until you can patch, the only meaningful compensating controls are organizational: restrict who holds template-authorship roles and external-provisioner access (the PR:H prerequisite), audit template edits and provisioner job completions, and avoid delegating template authorship or connecting external provisioners for untrusted teams - accepting that this reduces self-service flexibility rather than fully closing the gap.
Same technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today