{"data":{"id":"dfa252fd-20e8-4adc-8ae9-dc753c1a9e35","title":"GHSA-84rm-42xw-mx52: Coder's AI Bridge Proxy skips TLS certificate verification in default configuration","summary":"Coder's AI Bridge Proxy (`aibridgeproxyd`) set `InsecureSkipVerify: true` in the default transport of its goproxy server, so outbound HTTPS to the Coder access URL accepted any TLS certificate when no upstream proxy was configured. An on-path attacker could intercept Coder session tokens, BYOK provider API keys and full prompt and completion bodies, and the default transport also honored `HTTP_PROXY` and `HTTPS_PROXY`. The AI Bridge Proxy was introduced in v2.30.0, and the v2.29 ESR line is not affected.","solution":"Fixed in v2.34.2 (2.34 line), v2.33.8 (2.33 line) and v2.32.7 (2.32 line). The fix applies the secure transport (TLS 1.2 or higher using system root CAs) unconditionally. Workaround: ensure the Coder access URL uses a trusted certificate and secure the network path between the AI Bridge Proxy and the Coder server (for example, loopback or mTLS).","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-84rm-42xw-mx52","publishedAt":"2026-07-06T21:12:05.000Z","cveId":"CVE-2026-55436","cweIds":null,"cvssScore":null,"cvssSeverity":"high","severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":["github.com/coder/coder/v2@>= 2.30.0, < 2.32.7 (fixed: 2.32.7)","github.com/coder/coder/v2@>= 2.33.0, < 2.33.8 (fixed: 2.33.8)","github.com/coder/coder/v2@>= 2.34.0, < 2.34.2 (fixed: 2.34.2)"],"affectedPackageNames":["github.com/coder/coder/v2"],"affectedPackageRefs":["go:github.com/coder/coder/v2"],"affectedVendors":["Anthropic"],"affectedVendorsRaw":["Coder AI Bridge Proxy","Anthropic"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00258,"epssCheckedAt":"2026-10-14T18:05:58.877Z","kevDateAdded":null,"advisoryAliases":["GHSA-84rm-42xw-mx52"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":true,"disclosureDate":"2026-07-06T21:12:05.000Z","capecIds":null,"crossRefCount":0,"attackSophistication":"advanced","impactType":["confidentiality","integrity"],"aiComponentTargeted":"api","llmSpecific":false,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":null}}