CVE-2026-55433: Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, the devcontainer…

PriorityP432medium5.4CVSS 3.1

AVNACLPRLUINSUCNILAL

EPSS

0.39%

33.4th percentile

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, the devcontainer recreate endpoint relied on route middleware that checked only `ActionRead` on the workspace and, unlike the sibling delete endpoint, performed no `ActionUpdate` check before triggering the destructive rebuild. Exploitation requires an existing low-privilege role with access to the target workspace. The fix in versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2 adds an explicit `ActionUpdate` authorization check before the agent is dialed like the delete endpoint. No known workarounds are available.

Affected

11 ranges

Vendor	Product	Version range	Fixed in
coder	coder	< 2.29.17	2.29.17
coder	coder	—	—
coder	coder	—	—
coder	coder	—	—
coder	coder	>= 2.30.0 < 2.32.7	2.32.7
coder	coder	>= 2.33.0 < 2.33.8	2.33.8
coder	coder	>= 2.34.0 < 2.34.2	2.34.2
github.com	coder_coder_v2	>= 0 < 2.29.17	2.29.17
github.com	coder_coder_v2	>= 2.30.0 < 2.32.7	2.32.7
github.com	coder_coder_v2	>= 2.33.0 < 2.33.8	2.33.8
github.com	coder_coder_v2	>= 2.34.0 < 2.34.2	2.34.2

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.