EUVD-2026-42151
GHSA-5wg6-jmq2-53pw
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N
Requires non-default wildcard subdomain config (AC:H), authenticated attacker account (PR:L), victim browser visit (UI:R), crosses workspace ownership boundary (S:C), full read of victim app responses (C:H), no write or availability impact.
Primary rating from Vendor (https://github.com/coder/coder).
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
Summary
Coder's subdomain-based workspace app proxy allowed the same-owner CORS check to be bypassed. When a workspace-name subdomain segment parsed as a UUID, the workspace was resolved by ID without confirming the URL's username matched the real owner, while the CORS middleware trusted the unverified username in the hostname.
> Note: Practical exploitation requires subdomain app routing (wildcard hostname) enabled and a victim who visits the attacker's crafted app URL while authenticated.
Impact
An authenticated user could craft a subdomain encoding their own workspace UUID and a victim's username. If the victim visited the attacker's URL, the attacker's JavaScript could issue credentialed cross-origin fetch() requests to the victim's workspace apps and read the responses, exfiltrating data accessible through those apps.
Patches
The fix validates the subdomain username against the resolved workspace's actual owner and bases the same-owner CORS decision on the authoritative owner identity.
The fix was backported to all supported release lines:
Workarounds
None.
Resources
- Fix: #26086, #26085
Credits
Coder would like to thank Anthropic's Security Team (ANT-2026-22434) for independently disclosing this issue!
AnalysisAI
Cross-origin request forgery via CORS same-owner bypass in Coder's subdomain workspace app proxy allows an authenticated attacker to exfiltrate data from a victim's workspace apps. The flaw exists across Coder release lines 2.29 through 2.34, and was disclosed by Anthropic's Security Team. No public exploit exists and no CISA KEV listing is present, but the vulnerability is directly exploitable against any deployment with wildcard subdomain routing enabled, making prompt patching critical for affected configurations.
Technical ContextAI
Coder provides remote development environments accessed via subdomain-routed workspace app proxies (e.g., {app}-{agent}-{workspace}-{username}.coder.example.com). The CORS middleware grants 'same-owner' trust when the username in the subdomain hostname matches the workspace owner, permitting credentialed cross-origin requests. The root cause, classified as CWE-346 (Origin Validation Error), is a logic divergence in the resolution path: when the workspace-name segment of the subdomain parses as a UUID, workspace lookup switches to ID-based resolution without re-validating that the URL's embedded username corresponds to the actual workspace owner. The CORS middleware then trusted the unverified, attacker-controlled username in the hostname rather than the authoritative server-side owner identity, breaking the same-origin security boundary between users' workspace contexts. Affected packages are identified by CPE as pkg:go/github.com_coder_coder_v2 across multiple release branches.
RemediationAI
Upgrade to the vendor-released patched versions: v2.34.2 for the 2.34 release line, v2.33.8 for the 2.33 line, v2.32.7 for the 2.32 line, or v2.29.17 for the 2.29 ESR line, all available at https://github.com/coder/coder/releases. The fix validates the subdomain-encoded username against the authoritative workspace owner identity before granting same-owner CORS trust, closing the bypass. The vendor advisory at https://github.com/coder/coder/security/advisories/GHSA-5wg6-jmq2-53pw explicitly states no workarounds are available. For organizations unable to patch immediately, disabling wildcard subdomain-based workspace app routing eliminates exposure entirely, though this trade-off disables the workspace app proxy feature for all users. Fix implementation details are visible in upstream pull requests #26085 and #26086.
Same weakness CWE-346 – Origin Validation Error
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today