CVE-2026-55433

Executive Summary

CVE-2026-55433 is a missing authorization vulnerability in Coder, a platform for provisioning remote development environments via Terraform. The vulnerability resides in the devcontainer recreate endpoint, which relied on a route middleware that only checked ActionRead on the workspace. Unlike the sibling delete endpoint, it performed no ActionUpdate check before triggering the destructive rebuild. This allows a low-privilege user with ActionRead access to a workspace to trigger a destructive rebuild, potentially causing denial of service or data loss. The CVSS score is 5.4 (Medium), and exploitation requires an existing low-privilege role with access to the target workspace. No public proof-of-concept or exploit code is available at this time.

Supply Chain & Package Security

Coder is a Go-based application. The vulnerability is in the application's authorization logic, not in a dependency. However, organizations using Coder should ensure they are running a patched version to prevent unauthorized destructive actions on workspaces.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
• Base Score: 5.4 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: Low (I:L)
• Availability Impact: Low (A:L)

Threat Level: Medium. The vulnerability requires a low-privilege account with access to the target workspace. The impact is limited to integrity and availability, as the attacker can trigger a destructive rebuild but cannot read sensitive data.

Deep Dive & Mechanics

The vulnerability is in the devcontainer recreate endpoint. The route middleware only checked ActionRead on the workspace, meaning any user with read access could trigger a destructive rebuild. The rebuild process dials the agent and performs a destructive operation (recreating the devcontainer), which should require ActionUpdate authorization.

The fix adds an explicit ActionUpdate authorization check before the agent is dialed, similar to the delete endpoint. This ensures that only users with update permissions can trigger the destructive rebuild.

Vulnerable vs. Patched Code

Vulnerable Code (Before Patch):

// Vulnerable: Only checks ActionRead
func (s *Server) devcontainerRecreate(r *http.Request) (interface{}, error) {
    workspace, err := s.getWorkspace(r)
    if err != nil {
        return nil, err
    }
    // Missing ActionUpdate check
    // ... proceed to dial agent and recreate
}

Patched Code (After Patch):

// Patched: Adds ActionUpdate check
func (s *Server) devcontainerRecreate(r *http.Request) (interface{}, error) {
    workspace, err := s.getWorkspace(r)
    if err != nil {
        return nil, err
    }
    // Added ActionUpdate authorization check
    if err := s.authorize(r, ActionUpdate, workspace); err != nil {
        return nil, err
    }
    // ... proceed to dial agent and recreate
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• A low-privilege user account with ActionRead access to a target workspace.
• Network access to the Coder API endpoint.

Exploitation Steps:

1. Authenticate as the low-privilege user.
2. Identify the target workspace ID.
3. Send a POST request to the devcontainer recreate endpoint with the workspace ID.
4. The server will trigger a destructive rebuild without checking for ActionUpdate.

Example Request:

curl -X POST https://coder.example.com/api/v2/workspaces/{workspace_id}/devcontainer/recreate \
  -H "Authorization: Bearer <low_priv_token>"

Blue Team

Detection:

• Monitor for unauthorized devcontainer recreate requests from low-privilege users.
• Alert on any devcontainer recreate requests that do not originate from authorized administrators.

Mitigation:

• Apply the patch immediately.
• Review and restrict workspace permissions to ensure only trusted users have ActionRead access.
• Implement additional logging and monitoring for destructive workspace operations.

Indicators of Compromise (IOCs)

• Log Entries: Unauthorized devcontainer recreate requests from low-privilege users.
• API Calls: POST requests to /api/v2/workspaces/{workspace_id}/devcontainer/recreate from unexpected users.
• Workspace State: Unexpected workspace rebuilds or downtime.

Detection Engineering

YARA Rule

rule CVE_2026_55433_Coder_Devcontainer_Recreate {
    meta:
        description = "Detects unauthorized devcontainer recreate requests in Coder logs"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-55433"
    strings:
        $s1 = "devcontainer/recreate" nocase
        $s2 = "ActionRead" nocase
        $s3 = "unauthorized" nocase
    condition:
        all of ($s1, $s2) or ($s1 and $s3)
}

Sigma Rule

title: Coder Devcontainer Recreate Unauthorized Access
id: coder-devcontainer-recreate-unauthorized
status: experimental
description: Detects unauthorized devcontainer recreate requests in Coder logs
author: Valters IT
date: 2026-01-01
logsource:
    category: application
    product: coder
detection:
    selection:
        endpoint: "/api/v2/workspaces/*/devcontainer/recreate"
        method: "POST"
        user_role: "low-privilege"
    condition: selection
falsepositives:
    - Legitimate administrative actions
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2026-55433 - Coder Devcontainer Recreate Unauthorized Access";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/api/v2/workspaces/";
    http_uri;
    content:"/devcontainer/recreate";
    http_uri;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Coder to versions 2.29.7, 2.32.7, 2.33.8, or 2.34.2.
2. Review and restrict workspace permissions to ensure only trusted users have ActionRead access.
3. Implement additional logging and monitoring for destructive workspace operations.

Long-Term Measures:

• Conduct a thorough review of all authorization checks in the application.
• Implement role-based access control (RBAC) with least privilege principles.
• Regularly audit user permissions and access logs.

Workarounds:

• No known workarounds are available. Patching is required.

Valters IT
DevSecOps & Cyber Threat Intelligence Expert