CVE-2026-44454
HighCVSS 8.1Exploitation Probability (EPSS)
High risk84th percentile - higher than 84% of all known CVEs
Summary
In Coder before versions 2.29.7 and 2.30.2, the `dotfiles` registry module passed unsanitized user input to shell commands, allowing arbitrary code execution inside a provisioned workspace. An attacker could supply a crafted `dotfiles_uri` (e.g., containing shell command substitution like `$(...)`) to achieve command execution in their own workspace. The Create Workspace page's `mode=auto` deep links amplified this into a one-click attack without user confirmation.
Risk Assessment
The risk is remote code execution within workspaces, potentially leading to data theft, privilege escalation, or further attacks on infrastructure. The one-click attack vector increases susceptibility to social engineering.
Recommendation
Immediately upgrade Coder to version 2.29.7 or 2.30.2, which include input validation and removal of unsafe `eval`/`sh -c` usage. After updating, review workspaces for any suspicious `dotfiles_uri` values.
Other vulnerabilities in Coder
See all- CVE-2026-46354Critical
In Coder prior to versions 2.24.5, 2.29.13, 2.30.8, 2.31.12, 2.32.2, and 2.33.3, the `azureidentity.Validate()` function does not verify the PKCS#7 signature, only checking that the signer certificate chains to a trusted Azure CA. An attacker can embed a legitimate Azure certificate alongside arbitrary content, e.g., `{"vmId":"<target>"}`, and the forged `vmId` will be accepted, returning the victim workspace agent's session token.
- CVE-2026-55438Medium
In Coder prior to versions 2.29.17, 2.32.7, 2.33.8, and 2.34.2, the subdomain-based workspace app proxy allowed bypassing the same-owner CORS check. When a workspace-name subdomain segment parsed as a UUID, the workspace was resolved by ID without verifying the URL's username matched the real owner, while the CORS middleware trusted the unverified username in the hostname.
- CVE-2026-55437Medium
In Coder prior to versions 2.29.17, 2.32.7, 2.33.8, and 2.34.2, the `AgentLogLine` dashboard component used `ansi-to-html` without `escapeXML: true` and inserted the result via `dangerouslySetInnerHTML`, causing HTML embedded in agent logs to be rendered as live markup. Server-side sanitization did not neutralize HTML metacharacters.
- CVE-2026-55436High
In Coder from version 2.30.0 to 2.32.7, 2.33.8, and 2.34.2, the AI Bridge Proxy (`aibridgeproxyd`) created a goproxy server whose default transport set `InsecureSkipVerify: true`, accepting any TLS certificate for outbound HTTPS to the Coder access URL. This allows man-in-the-middle attacks.
- CVE-2026-55433Medium
In Coder prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, the devcontainer recreate endpoint only checked `ActionRead` on the workspace, missing an `ActionUpdate` check before triggering a destructive rebuild. An attacker with low privileges and workspace access could exploit this for unauthorized rebuilds.
- CVE-2026-55432Medium
In Coder prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, the `CreateSubAgent` RPC did not validate a requested app sharing level against the template's `MaxPortSharingLevel` before persisting workspace apps, letting a workspace owner exceed the administrator's configured maximum.
- CVE-2026-55431High
A vulnerability in Coder CLI allows session token theft by opening a malicious workspace app URL. An attacker (template author) can configure an external workspace app that, when `coder open app` is executed, substitutes the session token in the URL and opens it in the victim's browser.
- CVE-2026-55430Medium
A vulnerability in Coder allows an attacker to redirect traffic from the workspace app proxy to an arbitrary host via the X-Forwarded-Host header. The issue occurs when subdomain app routing (wildcard hostname) is enabled, a victim visits the attacker's shared app, and the upstream proxy does not strip this header.
- CVE-2026-55429High
In Coder prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, `UpsertWorkspaceApp` overwrites an existing app entry and `insertAgentApp` accepts the app ID from the `CompleteJob` payload without verifying it belongs to the workspace being built. This allows cross-workspace agent reassignment, requiring elevated privileges of a template author or external provisioner operator.
- CVE-2026-55428High
In Coder prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, the tailnet coordinator does not validate the AllowedIPs field supplied by agents, allowing an agent to spoof another UUID and intercept network traffic. This vulnerability lets unauthorized agents inject arbitrary routes into WireGuard peer configurations, potentially enabling man-in-the-middle attacks.
Original NVD description (English source)
Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7 and 2.30.2, the `dotfiles` registry module passed unsanitized user input to shell commands, allowing arbitrary code execution inside a provisioned workspace. Any user who supplied a crafted `dotfiles_uri` value (for example, one containing shell command substitution such as `$(...)`) could achieve command execution in their own workspace. The Create Workspace page's `mode=auto` deep links amplified this into a one-click attack: an attacker could craft a URL that prefilled `param.dotfiles_uri` and silently provisioned a workspace with the attacker-controlled value, with no explicit user confirmation. In versions 2.29.7 and 2.30.2, input validation was added to the dotfiles module to reject URIs and usernames containing special characters, and the unsafe `eval`/`sh -c` usage was removed. This eliminated the command injection at its source.