EUVD-2026-42148
GHSA-jqj2-x4c5-jfxm
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Network-reachable endpoint requires only a low-privilege authenticated account; scope unchanged with no confidentiality impact, only limited integrity and availability loss.
Primary rating from Vendor (https://github.com/coder/coder).
CVSS VectorVendor: https://github.com/coder/coder
Lifecycle Timeline
1DescriptionCVE.org
Summary
The devcontainer recreate endpoint relied on route middleware that checked only ActionRead on the workspace and, unlike the sibling delete endpoint, performed no ActionUpdate check before triggering the destructive rebuild.
> Note: Exploitation requires an existing low-privilege role with access to the target workspace.
Impact
Any authenticated principal with read-only workspace access, such as a Template Admin or Org Template Admin, could recreate a devcontainer, destroying uncommitted in-container state and, if called repeatedly, denying service. This is an authorization bypass leading to data loss and denial of service.
Patches
The fix adds an explicit ActionUpdate authorization check before the agent is dialed like the delete endpoint.
The fix was backported to all supported release lines:
Workarounds
None.
Resources
- Fix: #25812
Credits
Coder would like to thank Anthropic's Security Team (ANT-2026-22454) for independently disclosing this issue!
AnalysisAI
Authorization bypass in the Coder devcontainer recreate endpoint allows any authenticated user holding only read-level workspace access - such as Template Admin or Org Template Admin roles - to trigger a destructive container rebuild that destroys uncommitted in-container state. Unlike the sibling delete endpoint, which correctly enforces an ActionUpdate check, the recreate endpoint relied solely on route middleware verifying ActionRead, leaving the destructive operation unguarded against lower-privileged principals. No public exploit has been identified at time of analysis; vendor-confirmed patches are available across all supported release lines.
Technical ContextAI
Coder is a remote development environment platform written in Go (pkg:go/github.com_coder_coder_v2) that provisions and manages cloud workspaces and devcontainers. The affected logic sits in the devcontainer recreate HTTP endpoint, which triggers a full rebuild of a running container - a destructive, state-altering operation. Route-level middleware correctly checks ActionRead on the workspace object before reaching the handler, but unlike the analogous delete endpoint, the recreate endpoint omits the additional ActionUpdate authorization gate required before dialing the agent. This is a textbook CWE-862 (Missing Authorization) instance: authorization is partially enforced at one layer but absent at the layer that governs destructive write-class operations. The fix (PR #25812) inserts an explicit ActionUpdate check prior to agent invocation, mirroring the delete endpoint's pattern.
RemediationAI
Upgrade Coder to a patched version appropriate to your release line: v2.34.2 for the 2.34 line, v2.33.8 for the 2.33 line, v2.32.7 for the 2.32 line, or v2.29.17 for the 2.29 ESR line. Release artifacts are available at https://github.com/coder/coder/releases. The vendor advisory at https://github.com/coder/coder/security/advisories/GHSA-jqj2-x4c5-jfxm confirms no workarounds exist. As a temporary compensating control while patching, administrators could audit and restrict Template Admin and Org Template Admin role assignments to only principals who require workspace access, reducing the pool of accounts that could trigger the bypass - though this may impact legitimate administrative workflows and does not eliminate the vulnerability.
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today