CVE-2026-55432

Executive Summary

CVE-2026-55432 is a privilege escalation vulnerability in Coder, a platform for provisioning remote development environments via Terraform. The flaw resides in the CreateSubAgent RPC, which fails to validate a requested app sharing level against the template's configured MaxPortSharingLevel. This allows a workspace owner to exceed the administrator's configured maximum port sharing level, potentially exposing workspace applications to a wider audience than intended. The vulnerability has a CVSS score of 5.4 (Medium) and requires the attacker to have the ability to register sub-agent apps in a workspace they control. No public proof-of-concept (PoC) or exploit code is currently available, and the EPSS score is 0.0%, indicating low exploitation activity. The vendor has released patches in versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2.

Supply Chain & Package Security

Coder is a Go-based application. The vulnerability does not directly affect a package manager (NPM, PyPI, Ruby, Go) but is a server-side configuration bypass. Organizations using Coder should verify their deployment version and apply the patch.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
• Base Score: 5.4 (Medium)
• Attack Vector (AV): Network (N) – The vulnerability is exploitable over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required for exploitation.
• Privileges Required (PR): Low (L) – The attacker needs a valid workspace owner account.
• User Interaction (UI): None (N) – No user interaction is required.
• Scope (S): Unchanged (U) – The vulnerability does not affect other components.
• Confidentiality (C): Low (L) – Limited information disclosure (workspace apps may be exposed).
• Integrity (I): Low (L) – Limited integrity impact (app sharing level bypass).
• Availability (A): None (N) – No impact on availability.

Threat Level: Medium. The vulnerability requires authenticated access but allows bypassing an administrative security control. The lack of public exploit code and low EPSS score reduce immediate risk, but the potential for lateral movement or data exposure warrants prompt patching.

Deep Dive & Mechanics

Coder uses a MaxPortSharingLevel setting in templates to control how workspace applications (apps) can be shared. The sharing levels typically include:

• owner – Only the workspace owner can access.
• authenticated – Any authenticated user in the organization can access.
• public – Anyone with the URL can access.

The CreateSubAgent RPC is used to register sub-agent apps within a workspace. The vulnerability occurs because this RPC does not validate the requested sharing_level against the template's MaxPortSharingLevel before persisting the app. A workspace owner can craft a request with a higher sharing level (e.g., public) even if the template restricts it to owner or authenticated. This bypasses the administrator's intent and can expose sensitive development environments or internal tools.

Root Cause: Missing authorization check in the CreateSubAgent RPC handler. The server trusts the client-provided sharing level without verifying it against the template's maximum.

Attack Scenario:

1. An attacker gains access to a workspace (e.g., as a developer).
2. The attacker registers a sub-agent app with a sharing level of public.
3. The server accepts the request and makes the app accessible to anyone with the URL, bypassing the template's MaxPortSharingLevel.
4. The attacker can then share the app URL externally, potentially exposing sensitive data or services.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual Go):

func (s *Server) CreateSubAgent(ctx context.Context, req *pb.CreateSubAgentRequest) (*pb.CreateSubAgentResponse, error) {
    // No validation of req.SharingLevel against template's MaxPortSharingLevel
    app := &App{
        WorkspaceID:  req.WorkspaceID,
        SharingLevel: req.SharingLevel, // Directly trusted
        // ... other fields
    }
    err := s.db.CreateApp(ctx, app)
    // ...
}

Patched Code (Conceptual Go):

func (s *Server) CreateSubAgent(ctx context.Context, req *pb.CreateSubAgentRequest) (*pb.CreateSubAgentResponse, error) {
    // Fetch template's MaxPortSharingLevel
    template, err := s.db.GetTemplateByWorkspaceID(ctx, req.WorkspaceID)
    if err != nil {
        return nil, err
    }
    // Clamp the requested sharing level to the template's maximum
    clampedLevel := minSharingLevel(req.SharingLevel, template.MaxPortSharingLevel)
    app := &App{
        WorkspaceID:  req.WorkspaceID,
        SharingLevel: clampedLevel, // Enforced
        // ... other fields
    }
    err = s.db.CreateApp(ctx, app)
    // ...
}

The patch introduces a minSharingLevel function that ensures the app's sharing level does not exceed the template's configured maximum.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Access to a Coder workspace (authenticated as a workspace owner).
• Ability to call the CreateSubAgent RPC (e.g., via gRPC client or Coder API).

Exploitation Steps:

1. Identify the Coder server endpoint (e.g., https://coder.example.com).
2. Authenticate and obtain a session token.
3. Use a gRPC client (e.g., grpcurl) to call CreateSubAgent with a crafted request:

   grpcurl -d '{
     "workspace_id": "workspace-123",
     "app_name": "malicious-app",
     "sharing_level": "public",
     "url": "http://internal-service:8080"
   }' -H "Authorization: Bearer <token>" coder.example.com:443 coder.v1.CoderService/CreateSubAgent
   

4. The app is registered with public sharing level, bypassing the template's MaxPortSharingLevel.
5. Access the app via the generated URL (e.g., https://malicious-app--workspace-123.coder.example.com).

Note: No public exploit code is available. The above is a conceptual demonstration.

Blue Team (Detection & Defense)

Detection:

• Monitor for CreateSubAgent RPC calls with sharing_level values that exceed the template's MaxPortSharingLevel.
• Alert on workspace apps that are suddenly set to public or authenticated when the template restricts to owner.
• Review audit logs for unusual app registration activity.

Defense:

• Apply the patch immediately (versions 2.29.7, 2.32.7, 2.33.8, 2.34.2).
• As a workaround, disable wildcard app hostnames (CODER_WILDCARD_ACCESS_URL) to block subdomain-based app routing.
• Implement network segmentation to limit exposure of workspace apps.
• Enforce least privilege for workspace owners.

Indicators of Compromise (IOCs)

• Log Entries: CreateSubAgent RPC calls with sharing_level set to public or authenticated in workspaces where the template's MaxPortSharingLevel is owner.
• Network Traffic: gRPC requests to CoderService/CreateSubAgent with unusual sharing levels.
• Workspace Apps: Unexpected public or authenticated apps in workspaces that should be restricted.
• URL Patterns: Subdomain-based app URLs (e.g., *--workspace-id.coder.example.com) that are accessible without authentication.

Detection Engineering

YARA Rule

rule CVE_2026_55432_Coder_SharingLevel_Bypass {
    meta:
        description = "Detects Coder CreateSubAgent RPC requests with unauthorized sharing levels"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2026-55432"
    strings:
        $rpc_method = "CreateSubAgent"
        $sharing_public = "sharing_level: public"
        $sharing_auth = "sharing_level: authenticated"
        $max_sharing = "MaxPortSharingLevel"
    condition:
        $rpc_method and ($sharing_public or $sharing_auth) and not $max_sharing
}

Sigma Rule

title: Coder CreateSubAgent Sharing Level Bypass
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to bypass MaxPortSharingLevel in Coder via CreateSubAgent RPC
author: Valters IT
date: 2025-04-10
logsource:
    product: coder
    service: audit
detection:
    selection:
        EventID: "CreateSubAgent"
        RequestSharingLevel|re: "public|authenticated"
    filter:
        TemplateMaxPortSharingLevel: "owner"
    condition: selection and filter
falsepositives:
    - Legitimate administrative actions (rare)
level: high

Suricata Rule

alert tcp any any -> any 443 (msg:"CVE-2026-55432 Coder CreateSubAgent Sharing Level Bypass"; flow:to_server,established; content:"CreateSubAgent"; content:"sharing_level"; content:"public"; within:100; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Patch: Upgrade Coder to versions 2.29.7, 2.32.7, 2.33.8, or 2.34.2 (depending on your release branch).
2. Workaround: Disable wildcard app hostnames by setting CODER_WILDCARD_ACCESS_URL to an empty string or removing it. This blocks subdomain-based app routing, reducing the attack surface.

Long-Term Measures:

• Implement strict access controls for workspace owners.
• Regularly audit workspace app configurations.
• Monitor for anomalous RPC calls.
• Use network segmentation to isolate workspace apps.

Patch Details:

• The fix clamps the sub-agent app sharing level to the template's MaxPortSharingLevel. No other changes are required.

Valters IT
Securing Digital Frontiers