EUVD-2026-42149
GHSA-84rm-42xw-mx52
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
On-path MITM prerequisite makes AC:H; no auth or user interaction (PR:N/UI:N); intercepted tokens/keys give C:H and I:H, with no availability impact (A:N).
Primary rating from Vendor (https://github.com/coder/coder).
CVSS VectorVendor: https://github.com/coder/coder
Lifecycle Timeline
1DescriptionCVE.org
Summary
The AI Bridge Proxy (aibridgeproxyd) created a goproxy server whose default transport set InsecureSkipVerify: true and only assigned a secure transport when an upstream proxy was configured. In the default configuration (no upstream proxy), outbound HTTPS to the Coder access URL accepted any TLS certificate.
> Note: Practical exploitation requires an on-path (man-in-the-middle) position between the AI Bridge Proxy and the Coder server. Deployments where they are co-located over loopback are effectively unaffected.
Impact
An attacker positioned between the proxy and the Coder server, via ARP spoofing, DNS poisoning or control of proxy environment variables, could intercept injected Coder session tokens, user-supplied provider API keys (BYOK) and full request and response bodies including prompts and completions. The default transport also honored HTTP_PROXY and HTTPS_PROXY, allowing environment-based traffic redirection.
Patches
The fix applies the secure transport (TLS 1.2 or higher using system root CAs) unconditionally. The AI Bridge Proxy was introduced in v2.30.0. Earlier release lines including the v2.29 ESR line are not affected.
The fix is available in the following releases:
Workarounds
Ensure the Coder access URL uses a trusted certificate and secure the network path between the AI Bridge Proxy and the Coder server (for example, loopback or mTLS).
Resources
- Fix: #26131
Credits
Coder would like to thank Anthropic's Security Team (ANT-2026-22455) for independently disclosing this issue!
AnalysisAI
Man-in-the-middle interception affects the Coder AI Bridge Proxy (aibridgeproxyd), introduced in Coder v2.30.0, where the goproxy default transport set InsecureSkipVerify:true and only used a secure transport when an upstream proxy was configured. In the default no-upstream-proxy configuration, outbound HTTPS to the Coder access URL accepted any TLS certificate, letting an on-path attacker decrypt traffic and steal Coder session tokens, BYOK provider API keys, and full prompt/completion bodies. CVSS 7.4 (High); there is no public exploit identified at time of analysis and it is not listed in CISA KEV, so risk hinges on an attacker already holding a network-adjacent position.
Technical ContextAI
The root cause is CWE-295 (Improper Certificate Validation). Go's crypto/tls verifies the server certificate chain against the system root CAs by default, but setting tls.Config.InsecureSkipVerify=true disables that verification entirely, so any presented certificate - including an attacker's self-signed one - is trusted. The affected package is the Go module github.com/coder/coder/v2 (per the pkg:go CPE data), specifically the aibridgeproxyd component that proxies AI/LLM traffic between the local AI Bridge Proxy and the central Coder server over HTTPS. Because the flawed default transport also honored the HTTP_PROXY/HTTPS_PROXY environment variables, an attacker able to influence process environment could additionally redirect outbound traffic through a proxy they control, compounding the missing certificate check.
RemediationAI
Upgrade to a fixed release, which applies the secure transport (TLS 1.2+ validated against system root CAs) unconditionally: Vendor-released patch v2.34.2 (https://github.com/coder/coder/releases/tag/v2.34.2) for the 2.34 line, v2.33.8 for the 2.33 line, or v2.32.7 for the 2.32 line; the underlying fix is PR #26131 (https://github.com/coder/coder/pull/26131). If you cannot patch immediately, apply the vendor workarounds: ensure the Coder access URL presents a trusted, properly validated certificate, and secure the network path between the AI Bridge Proxy and the Coder server - for example co-locate them over loopback or enforce mutual TLS (mTLS) - which removes the attacker's on-path opportunity but requires certificate/network reconfiguration. Additionally, audit and lock down the process environment for the proxy to prevent attacker-controlled HTTP_PROXY/HTTPS_PROXY variables from redirecting traffic; the side effect is that any legitimately required upstream proxy must be configured through trusted means. As tokens and API keys may already have been exposed, rotate Coder session tokens and any BYOK provider API keys after patching.
Same weakness CWE-295 – Improper Certificate Validation
View allSame technique Code Injection
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today