MediumVulnerability
GHSA-x9qq-2qh5-8rxf: Coder's sub-agent app registration bypasses template port-sharing policy enforcement
- Identifiers
- CVE-2026-55432GHSA-x9qq-2qh5-8rxf
- Published
- Record updated
- Affected
- github.com/coder/coder/v2 < 2.29.17, fixed in 2.29.17
- github.com/coder/coder/v2 >= 2.30.0, < 2.32.7, fixed in 2.32.7
- github.com/coder/coder/v2 >= 2.33.0, < 2.33.8, fixed in 2.33.8
- and 1 more
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
- EPSS
- 0.3%
Summary
The `CreateSubAgent` RPC in Coder did not check a requested app sharing level against the template's `MaxPortSharingLevel` before saving workspace apps. A workspace owner with an agent token could register a sub-agent app as `PUBLIC` even when the maximum was `owner`, exposing it to unauthenticated users through the wildcard app domain. The issue affects only deployments using Enterprise port-sharing policy and wildcard app hostnames.
Mitigation
Fixed in v2.34.2 (2.34 line), v2.33.8 (2.33), v2.32.7 (2.32) and v2.29.17 (2.29 ESR). The fix clamps the sub-agent app sharing level to the template's `MaxPortSharingLevel`. Workaround: disable wildcard app hostnames by unsetting `CODER_WILDCARD_ACCESS_URL` to block subdomain-based app routing.
Related items
- MediumCVE-2026-107430: VideoWhisper Site Manager for ChatGPT, Claude, Codex missing authorization checkSame vendor · NVD/CVE Database
- HighCVE-2026-101998: Docker Sandboxes fail open when masking credentials in proxy responsesSame vendor · NVD/CVE Database
- HighCVE-2026-103435: Claude Code symlink race condition allows writes outside project directorySame vendor · NVD/CVE Database
- HighGHSA-6qxp-vccf-f47h: MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP serverSame vendor · GitHub Advisory Database
- HighCVE-2026-103012: Claude Code stored API key overrides organization policy sign-inSame vendor · NVD/CVE Database