CVE-2026-55435

In Coder prior to versions 2.24.5, 2.29.13, 2.30.8, 2.31.12, 2.32.2, and 2.33.3, the `azureidentity.Validate()` function does not verify the PKCS#7 signature, only checking that the signer certificate chains to a trusted Azure CA. An attacker can embed a legitimate Azure certificate alongside arbitrary content, e.g., `{"vmId":"<target>"}`, and the forged `vmId` will be accepted, returning the victim workspace agent's session token.

In Coder prior to versions 2.29.17, 2.32.7, 2.33.8, and 2.34.2, the subdomain-based workspace app proxy allowed bypassing the same-owner CORS check. When a workspace-name subdomain segment parsed as a UUID, the workspace was resolved by ID without verifying the URL's username matched the real owner, while the CORS middleware trusted the unverified username in the hostname.

In Coder prior to versions 2.29.17, 2.32.7, 2.33.8, and 2.34.2, the `AgentLogLine` dashboard component used `ansi-to-html` without `escapeXML: true` and inserted the result via `dangerouslySetInnerHTML`, causing HTML embedded in agent logs to be rendered as live markup. Server-side sanitization did not neutralize HTML metacharacters.

In Coder from version 2.30.0 to 2.32.7, 2.33.8, and 2.34.2, the AI Bridge Proxy (`aibridgeproxyd`) created a goproxy server whose default transport set `InsecureSkipVerify: true`, accepting any TLS certificate for outbound HTTPS to the Coder access URL. This allows man-in-the-middle attacks.

In Coder prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, the devcontainer recreate endpoint only checked `ActionRead` on the workspace, missing an `ActionUpdate` check before triggering a destructive rebuild. An attacker with low privileges and workspace access could exploit this for unauthorized rebuilds.

In Coder prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, the `CreateSubAgent` RPC did not validate a requested app sharing level against the template's `MaxPortSharingLevel` before persisting workspace apps, letting a workspace owner exceed the administrator's configured maximum.

A vulnerability in Coder CLI allows session token theft by opening a malicious workspace app URL. An attacker (template author) can configure an external workspace app that, when `coder open app` is executed, substitutes the session token in the URL and opens it in the victim's browser.

A vulnerability in Coder allows an attacker to redirect traffic from the workspace app proxy to an arbitrary host via the X-Forwarded-Host header. The issue occurs when subdomain app routing (wildcard hostname) is enabled, a victim visits the attacker's shared app, and the upstream proxy does not strip this header.

In Coder prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, `UpsertWorkspaceApp` overwrites an existing app entry and `insertAgentApp` accepts the app ID from the `CompleteJob` payload without verifying it belongs to the workspace being built. This allows cross-workspace agent reassignment, requiring elevated privileges of a template author or external provisioner operator.

In Coder prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, the tailnet coordinator does not validate the AllowedIPs field supplied by agents, allowing an agent to spoof another UUID and intercept network traffic. This vulnerability lets unauthorized agents inject arbitrary routes into WireGuard peer configurations, potentially enabling man-in-the-middle attacks.