CVE-2026-55428

Executive Summary

CVE-2026-55428 is a critical vulnerability in Coder, a platform for provisioning remote development environments via Terraform. The flaw resides in the tailnet coordinator component, which manages WireGuard peer configurations for workspace agents. The coordinator validates that an agent's Addresses derive from its authenticated UUID but fails to apply the same check to AllowedIPs. This allows a malicious or compromised agent to inject arbitrary IP prefixes into the WireGuard peer configuration of other tunnel peers, potentially enabling network traffic redirection, interception, or unauthorized access to internal resources. The vulnerability has a CVSS score of 8.2 (High) and affects all Coder versions prior to the patched releases. No public exploit code or proof-of-concept is currently available, and the EPSS score is 0.0%, indicating low exploitation likelihood at this time. However, the impact is significant for organizations using Coder to manage remote development environments, as an attacker with agent access could pivot to other network segments.

Supply Chain & Package Security

Coder is a Go-based application distributed as a binary or container image. The vulnerability is in the core server component, not in a third-party package. However, organizations should verify the integrity of their Coder installations by checking checksums or signatures from the official Coder releases. The fix is included in versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2. Users should upgrade to these versions or later. There is no known compromise of the Coder supply chain related to this CVE.

CVSS Breakdown & Threat Level

• CVSS Score: 8.2 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
• Attack Vector: Network (AV:N) – The vulnerability is exploitable over the network.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: Low (PR:L) – An attacker needs valid agent credentials or the ability to compromise an agent.
• User Interaction: None (UI:N) – No user action is required.
• Scope: Unchanged (S:U) – The vulnerable component and the impacted component are the same.
• Confidentiality Impact: High (C:H) – An attacker could intercept or redirect sensitive traffic.
• Integrity Impact: High (I:H) – An attacker could inject malicious routes, altering network behavior.
• Availability Impact: None (A:N) – The vulnerability does not directly affect availability.

Threat Level: High. While no public exploit exists, the low complexity and potential for network pivoting make this a serious risk for Coder deployments.

Deep Dive & Mechanics

Coder uses a tailnet coordinator to manage WireGuard tunnels between workspace agents and users. Each agent authenticates with a UUID and is assigned a set of IP addresses (Addresses) that it is allowed to use. The coordinator validates that these addresses derive from the agent's UUID to prevent spoofing. However, the AllowedIPs field, which specifies which IP ranges the peer is allowed to route through the tunnel, is not validated. An agent can supply arbitrary AllowedIPs prefixes, which are forwarded verbatim to other peers. These peers then install the prefixes into their WireGuard configuration, effectively allowing the malicious agent to route traffic for those IP ranges through its tunnel.

Attack Scenario:

1. An attacker compromises a Coder workspace agent (e.g., via a vulnerable dependency or weak credentials).
2. The attacker modifies the agent's WireGuard configuration to include AllowedIPs for internal network ranges (e.g., 10.0.0.0/8, 192.168.0.0/16).
3. The coordinator accepts these prefixes without validation and distributes them to other peers.
4. Other peers (e.g., user workstations) install the malicious routes, sending traffic for those internal ranges to the attacker's agent.
5. The attacker can then intercept, modify, or redirect traffic, potentially gaining access to sensitive internal services.

Root Cause: Missing authorization check on AllowedIPs field in the tailnet coordinator.

Vulnerable vs. Patched Code

Vulnerable Code (Pre-2.29.7):

// In the coordinator's agent handler
func handleAgentUpdate(agent *Agent) {
    // Validate Addresses
    for _, addr := range agent.Addresses {
        if !deriveFromUUID(addr, agent.UUID) {
            reject("invalid address")
        }
    }
    // No validation for AllowedIPs
    for _, ip := range agent.AllowedIPs {
        // Directly forwarded to peers
        peer.AllowedIPs = append(peer.AllowedIPs, ip)
    }
}

Patched Code (2.29.7+):

func handleAgentUpdate(agent *Agent) {
    // Validate Addresses
    for _, addr := range agent.Addresses {
        if !deriveFromUUID(addr, agent.UUID) {
            reject("invalid address")
        }
    }
    // Validate AllowedIPs
    for _, ip := range agent.AllowedIPs {
        if !deriveFromUUID(ip, agent.UUID) {
            reject("invalid allowed IP")
        }
        peer.AllowedIPs = append(peer.AllowedIPs, ip)
    }
}

The fix adds the same UUID-based validation to AllowedIPs that was already applied to Addresses. This ensures that an agent can only advertise IP prefixes that are derived from its authenticated UUID.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a Coder workspace agent (e.g., via compromised credentials or a vulnerable container).
• Ability to modify the agent's WireGuard configuration (e.g., via root access or a misconfigured agent).

Steps:

1. Identify the agent's WireGuard interface (typically wg0).
2. Add a malicious AllowedIPs entry to the agent's configuration:

   sudo wg set wg0 peer <peer_public_key> allowed-ips 10.0.0.0/8,192.168.0.0/16
   

3. The coordinator will accept the new AllowedIPs and propagate them to other peers.
4. Monitor incoming traffic on the agent to capture redirected packets:

   sudo tcpdump -i wg0 -n
   

Note: No public exploit code is available. This is a conceptual demonstration.

Blue Team

Detection:

• Monitor coordinator logs for agents advertising unexpected AllowedIPs prefixes. Look for entries like:

  agent <UUID> updated AllowedIPs: [10.0.0.0/8, 192.168.0.0/16]
  

• Use network monitoring to detect unusual WireGuard routes being propagated.

Hunting:

• Query Coder's internal database for agents with AllowedIPs that do not match their assigned Addresses.
• Check for agents that have modified their WireGuard configuration outside of normal provisioning.

Mitigation:

• Upgrade to patched versions immediately.
• If upgrade is not possible, implement a workaround by monitoring coordinator logs for suspicious AllowedIPs changes.
• Restrict agent access to only necessary network ranges using firewall rules.

Indicators of Compromise (IOCs)

• Network: Unexpected AllowedIPs prefixes in WireGuard peer configurations, especially for internal or private IP ranges (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16).
• Logs: Coordinator log entries showing agents updating AllowedIPs to non-standard prefixes.
• Agent Behavior: Agents advertising routes that do not correspond to their assigned workspace network.
• Traffic: Increased traffic to/from an agent on ports typically used for internal services (e.g., SSH on 22, RDP on 3389, HTTP on 80/443).

Detection Engineering

YARA Rule

rule CVE_2026_55428_Coder_AllowedIPs_Exploit {
    meta:
        description = "Detects Coder agent configuration with suspicious AllowedIPs"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-55428"
    strings:
        $allowed_ips = /AllowedIPs\s*=\s*[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\/[0-9]{1,2}/ nocase
        $private_range = /(10\.|172\.(1[6-9]|2[0-9]|3[0-1])\.|192\.168\.)/ nocase
    condition:
        $allowed_ips and $private_range
}

Sigma Rule

title: Coder AllowedIPs Injection
id: 8f4a2b1c-3d5e-4f7a-9b8c-1d2e3f4a5b6c
status: experimental
description: Detects Coder coordinator logs indicating an agent advertising unexpected AllowedIPs prefixes
author: Valters IT
date: 2026-01-01
logsource:
    product: coder
    service: coordinator
detection:
    selection:
        EventID: "agent_update"
        AllowedIPs|contains: 
            - "10."
            - "172.16."
            - "172.17."
            - "172.18."
            - "172.19."
            - "172.20."
            - "172.21."
            - "172.22."
            - "172.23."
            - "172.24."
            - "172.25."
            - "172.26."
            - "172.27."
            - "172.28."
            - "172.29."
            - "172.30."
            - "172.31."
            - "192.168."
    condition: selection
falsepositives:
    - Legitimate use of private IP ranges in Coder workspaces
level: high

Suricata Rule

alert udp any any -> any 51820 (msg:"CVE-2026-55428 Coder AllowedIPs Injection"; content:"|00 00 00 00|"; depth:4; offset:0; content:"|01 00 00 00|"; distance:4; within:4; content:"|0a 00 00 00|"; distance:8; within:4; sid:1000001; rev:1;)

Note: This rule is a placeholder and would need to be tailored to the specific WireGuard handshake or data packet structure. The actual detection should focus on log analysis rather than network traffic due to encryption.

Remediation & Mitigation

Immediate Actions:

1. Upgrade Coder to version 2.29.7, 2.32.7, 2.33.8, or 2.34.2 (or later) as soon as possible.
2. Monitor coordinator logs for any agents advertising unexpected AllowedIPs prefixes. Investigate and isolate any suspicious agents.
3. Review agent configurations to ensure only authorized IP ranges are used.

Long-Term Measures:

• Implement network segmentation to limit the impact of a compromised agent.
• Use strong authentication and access controls for workspace agents.
• Regularly audit Coder configurations and logs for anomalies.
• Subscribe to Coder security advisories for future updates.

Workaround (if upgrade is not possible):

• Deploy a custom monitoring script that parses coordinator logs and alerts on any AllowedIPs changes that do not match the agent's assigned Addresses.

Report generated by Valters IT DevSecOps & CTI Division. For questions, contact security@valters-it.com.