Vulnerability Description
Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, the devcontainer recreate endpoint relied on route middleware that checked only `ActionRead` on the workspace and, unlike the sibling delete endpoint, performed no `ActionUpdate` check before triggering the destructive rebuild. Exploitation requires an existing low-privilege role with access to the target workspace. The fix in versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2 adds an explicit `ActionUpdate` authorization check before the agent is dialed like the delete endpoint. No known workarounds are available.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Coder | Coder | < 2.29.17 |
Related Weaknesses (CWE)
References
- https://github.com/coder/coder/pull/25812Issue TrackingPatch
- https://github.com/coder/coder/releases/tag/v2.29.17Release Notes
- https://github.com/coder/coder/releases/tag/v2.32.7Release Notes
- https://github.com/coder/coder/releases/tag/v2.33.8Release Notes
- https://github.com/coder/coder/releases/tag/v2.34.2Release Notes
- https://github.com/coder/coder/security/advisories/GHSA-jqj2-x4c5-jfxmPatchVendor Advisory
FAQ
What is CVE-2026-55433?
CVE-2026-55433 is a vulnerability with a CVSS score of 5.4 (MEDIUM). Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, the devcontainer recreate endpoint relied on route middlewa...
How severe is CVE-2026-55433?
CVE-2026-55433 has been rated MEDIUM with a CVSS base score of 5.4/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-55433?
Check the references section above for vendor advisories and patch information. Affected products include: Coder Coder.