{"data":{"id":"088a0998-6353-433a-a05b-df804826e0ad","title":"GHSA-x9qq-2qh5-8rxf: Coder's sub-agent app registration bypasses template port-sharing policy enforcement","summary":"The `CreateSubAgent` RPC in Coder did not check a requested app sharing level against the template's `MaxPortSharingLevel` before saving workspace apps. A workspace owner with an agent token could register a sub-agent app as `PUBLIC` even when the maximum was `owner`, exposing it to unauthenticated users through the wildcard app domain. The issue affects only deployments using Enterprise port-sharing policy and wildcard app hostnames.","solution":"Fixed in v2.34.2 (2.34 line), v2.33.8 (2.33), v2.32.7 (2.32) and v2.29.17 (2.29 ESR). The fix clamps the sub-agent app sharing level to the template's `MaxPortSharingLevel`. Workaround: disable wildcard app hostnames by unsetting `CODER_WILDCARD_ACCESS_URL` to block subdomain-based app routing.","labels":["security","industry"],"sourceUrl":"https://github.com/advisories/GHSA-x9qq-2qh5-8rxf","publishedAt":"2026-07-06T21:08:32.000Z","cveId":"CVE-2026-55432","cweIds":null,"cvssScore":null,"cvssSeverity":"medium","severity":"medium","attackType":["other"],"issueType":"vulnerability","affectedPackages":["github.com/coder/coder/v2@< 2.29.17 (fixed: 2.29.17)","github.com/coder/coder/v2@>= 2.30.0, < 2.32.7 (fixed: 2.32.7)","github.com/coder/coder/v2@>= 2.33.0, < 2.33.8 (fixed: 2.33.8)","github.com/coder/coder/v2@>= 2.34.0, < 2.34.2 (fixed: 2.34.2)"],"affectedPackageNames":["github.com/coder/coder/v2"],"affectedPackageRefs":["go:github.com/coder/coder/v2"],"affectedVendors":["Anthropic"],"affectedVendorsRaw":["Coder","Anthropic"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00315,"epssCheckedAt":"2026-10-14T18:05:59.662Z","kevDateAdded":null,"advisoryAliases":["GHSA-x9qq-2qh5-8rxf"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":true,"disclosureDate":"2026-07-06T21:08:32.000Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity"],"aiComponentTargeted":"agent","llmSpecific":false,"classifierConfidence":0.6,"researchCategory":null,"atlasIds":null}}