CVE-2026-55428: Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, the tailnet…

PriorityP349high8.2CVSS 3.1

AVNACHPRLUINSCCHIHAN

EPSS

0.40%

34.5th percentile

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, the tailnet coordinator validates that an agent's `Addresses` derive from its authenticated UUID but applies no equivalent check to `AllowedIPs`. The coordinator forwards agent-supplied `AllowedIPs` verbatim to tunnel peers which install them into the WireGuard peer configuration. The fix in versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2 validates each `AllowedIPs` prefix against the authenticating agent's UUID just like `Addresses`. As a workaround, monitor coordinator logs for agents advertising unexpected `AllowedIPs` prefixes.

Affected

11 ranges

Vendor	Product	Version range	Fixed in
coder	coder	< 2.29.17	2.29.17
coder	coder	—	—
coder	coder	—	—
coder	coder	—	—
coder	coder	>= 2.30.0 < 2.32.7	2.32.7
coder	coder	>= 2.33.0 < 2.33.8	2.33.8
coder	coder	>= 2.34.0 < 2.34.2	2.34.2
github.com	coder_coder_v2	>= 0 < 2.29.17	2.29.17
github.com	coder_coder_v2	>= 2.30.0 < 2.32.7	2.32.7
github.com	coder_coder_v2	>= 2.33.0 < 2.33.8	2.33.8
github.com	coder_coder_v2	>= 2.34.0 < 2.34.2	2.34.2

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.