What is the CVSS score of CVE-2026-55432?

CVE-2026-55432 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.3%.

Is there a patch available for CVE-2026-55432?

Yes, a patch is available for CVE-2026-55432. Update the affected software to the latest version immediately.

Coder CVE-2026-55432

EUVD-2026-42147 MEDIUM

Missing Authorization (CWE-862)

2026-07-06 https://github.com/coder/coder

GHSA-x9qq-2qh5-8rxf

Authentication Bypass

5.4

CVSS 3.1 · Vendor: https://github.com/coder/coder

Severity by source

Vendor (https://github.com/coder/coder) PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

vuln.today AI

5.4 MEDIUM

Network-reachable RPC requires authenticated workspace owner (PR:L); no UI needed; impact bounded to low C/I with no availability effect.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (https://github.com/coder/coder).

CVSS VectorVendor: https://github.com/coder/coder

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 06, 2026 - 22:35 vuln.today

DescriptionCVE.org

Summary

The CreateSubAgent RPC did not validate a requested app sharing level against the template's MaxPortSharingLevel before persisting workspace apps, letting a workspace owner exceed the administrator's configured maximum.

> Note: Exploitation requires the ability to register sub-agent apps in a workspace the attacker controls.

Impact

A workspace owner with an agent token could register a sub-agent app as PUBLIC even when the template's MaxPortSharingLevel was owner, exposing the app to unauthenticated users via the wildcard app domain. This affected only deployments using Enterprise port-sharing policy and wildcard app hostnames and required an authenticated workspace owner with an agent token.

Patches

The fix clamps the sub-agent app sharing level to the template's MaxPortSharingLevel.

The fix was backported to all supported release lines:

Release line	Patched version
2.34	v2.34.2
2.33	v2.33.8
2.32	v2.32.7
2.29 (ESR)	v2.29.17

Workarounds

Disable wildcard app hostnames (CODER_WILDCARD_ACCESS_URL) to block subdomain-based app routing.

Resources

Fix: #26061

Credits

Coder would like to thank Anthropic's Security Team (ANT-2026-22452) for independently disclosing this issue!

AnalysisAI

Port-sharing policy bypass in Coder's CreateSubAgent RPC allows an authenticated workspace owner to register sub-agent apps at sharing levels exceeding the template's administrator-configured MaxPortSharingLevel, potentially exposing workspace apps as PUBLIC to unauthenticated users via wildcard app subdomains. Exploitation is gated behind authenticated workspace ownership with an agent token and requires an Enterprise deployment with both port-sharing policy enforcement and wildcard app hostnames active - making this a meaningful privilege escalation within a constrained environment rather than a broadly exploitable network flaw. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Authenticate as Coder workspace owner

Delivery

Obtain valid agent token for controlled workspace

Exploit

Issue CreateSubAgent RPC with PUBLIC sharing level

Execution

Server persists level without policy validation

Persist

Workspace app becomes publicly routable via wildcard subdomain

Impact

Unauthenticated users access restricted app

Access

Authenticate as Coder workspace owner

Delivery

Obtain valid agent token for controlled workspace

Exploit

Issue CreateSubAgent RPC with PUBLIC sharing level

Execution

Server persists level without policy validation

Persist

Workspace app becomes publicly routable via wildcard subdomain

Impact

Unauthenticated users access restricted app

Vulnerability AssessmentAI

Exploitation	Exploitation requires all of the following simultaneously: (1) the attacker is an authenticated Coder workspace owner with a valid agent token for a workspace they control; (2) the Coder deployment is running the Enterprise tier with port-sharing policy enforcement active (MaxPortSharingLevel set to a restrictive value such as owner or authenticated); and (3) wildcard app hostnames are enabled via CODER_WILDCARD_ACCESS_URL. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 score of 5.4 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) accurately reflects the bounded impact: network reachable, low complexity, but authenticated exploitation only (PR:L). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An authenticated Coder workspace owner with an active agent token issues a crafted CreateSubAgent RPC call specifying a sharing level of PUBLIC for a workspace app, even though the template's MaxPortSharingLevel is set to owner. Because the server previously did not validate this field against the template policy, the PUBLIC sharing level is persisted. …
Remediation	The primary remediation is to upgrade to a patched release: v2.34.2 (2.34 line), v2.33.8 (2.33 line), v2.32.7 (2.32 line), or v2.29.17 (2.29 ESR line), all available at https://github.com/coder/coder/releases. … Detailed patch versions, workarounds, and compensating controls in full report.