CVE-2026-55436

Executive Summary

CVE-2026-55436 is a critical TLS certificate validation bypass vulnerability in Coder’s AI Bridge Proxy (aibridgeproxyd). The proxy, which acts as a goproxy server for AI-related traffic, was configured with InsecureSkipVerify: true by default. This means that in the absence of an explicit upstream proxy configuration, all outbound HTTPS connections from the AI Bridge Proxy to the Coder access URL would accept any TLS certificate, including self-signed or malicious ones. An attacker with a man-in-the-middle (MITM) position on the network path between the proxy and the Coder server could intercept, decrypt, and modify traffic, potentially exfiltrating sensitive data or injecting malicious payloads. The vulnerability affects all deployments where the AI Bridge Proxy and Coder server are not co-located on the same host (loopback). The fix enforces TLS 1.2 or higher with system root CAs for all outbound connections.

Supply Chain & Package Security

This vulnerability is in the Go-based aibridgeproxyd binary, which is part of the Coder platform. The insecure default transport is a supply chain risk because it undermines the trust model of the entire AI Bridge Proxy component. Organizations using Coder’s AI features should verify the integrity of their Coder installation and ensure they are running a patched version. The Go module crypto/tls is used, and the vulnerability stems from a misconfiguration in the http.Transport struct.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
• Base Score: 7.4 (High)
• Attack Vector (AV): Network – the attacker must be on the network path.
• Attack Complexity (AC): High – requires a MITM position, which is not trivial but achievable in shared networks or compromised infrastructure.
• Privileges Required (PR): None – no authentication needed.
• User Interaction (UI): None – no user action required.
• Scope (S): Unchanged – the vulnerable component is the only one affected.
• Confidentiality (C): High – all traffic can be decrypted.
• Integrity (I): High – traffic can be modified.
• Availability (A): None – no denial-of-service impact.

Threat Level: High. While the attack complexity is high, the impact on confidentiality and integrity is severe. The vulnerability is particularly dangerous in multi-tenant or cloud environments where the AI Bridge Proxy may traverse shared network segments.

Deep Dive & Mechanics

The AI Bridge Proxy (aibridgeproxyd) is a component that proxies AI-related requests from development environments to the Coder server. It uses a goproxy server internally. The vulnerability lies in the initialization of the HTTP transport used for outbound connections.

In the vulnerable code (versions 2.30.0 through 2.34.1), the default http.Transport is created with TLSClientConfig: &tls.Config{InsecureSkipVerify: true}. This transport is used when no upstream proxy is configured. The secure transport (with proper TLS verification) is only assigned when an upstream proxy is explicitly set. This means that in the default configuration, all HTTPS connections to the Coder access URL are made without verifying the server’s TLS certificate.

An attacker who can intercept the network traffic between the AI Bridge Proxy and the Coder server (e.g., via ARP spoofing, rogue Wi-Fi, or compromised router) can present a fake TLS certificate. The proxy will accept it, allowing the attacker to decrypt and read all traffic, including API keys, workspace tokens, and AI model prompts. The attacker can also modify responses, potentially injecting malicious code into development environments.

The fix in versions 2.32.7, 2.33.8, and 2.34.2 removes the insecure default and always uses a secure transport with TLS 1.2 or higher and system root CAs.

Vulnerable vs. Patched Code

Vulnerable Code (Go):

// Default transport with insecure TLS
var defaultTransport = &http.Transport{
    TLSClientConfig: &tls.Config{InsecureSkipVerify: true},
}

// Only set secure transport if upstream proxy is configured
if upstreamProxy != "" {
    transport = &http.Transport{
        TLSClientConfig: &tls.Config{InsecureSkipVerify: false},
        Proxy:           http.ProxyURL(upstreamProxyURL),
    }
} else {
    transport = defaultTransport
}

Patched Code (Go):

// Always use secure transport
var transport = &http.Transport{
    TLSClientConfig: &tls.Config{
        MinVersion: tls.VersionTLS12,
        RootCAs:    nil, // Use system root CAs
    },
}

// If upstream proxy is configured, add proxy settings
if upstreamProxy != "" {
    transport.Proxy = http.ProxyURL(upstreamProxyURL)
}

The key difference is that InsecureSkipVerify is never set to true, and MinVersion is enforced to TLS 1.2.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A network position between the AI Bridge Proxy and the Coder server (e.g., same subnet, ARP spoofing, or compromised gateway).
• Ability to intercept and modify TLS traffic (e.g., using a tool like mitmproxy or bettercap).

Lab Setup:

1. Set up a Coder server (e.g., coder.example.com) with a valid TLS certificate.
2. Deploy a vulnerable Coder agent (version 2.30.0) with AI Bridge Proxy enabled.
3. On an attacker machine on the same network, set up a MITM proxy:

   # Using mitmproxy
   mitmproxy --mode transparent --listen-port 8080
   

4. Redirect traffic from the AI Bridge Proxy to the attacker machine (e.g., using ARP spoofing):

   # Using bettercap
   sudo bettercap -eval "set arp.spoof.targets 192.168.1.100; arp.spoof on"
   

5. The AI Bridge Proxy will connect to coder.example.com through the attacker’s proxy. The attacker presents a self-signed certificate, and the vulnerable proxy accepts it.
6. The attacker can now decrypt and view all traffic, including API keys and workspace data.

Proof of Concept (No public exploit available):

# Simulate the insecure connection
curl -k https://coder.example.com/api/v2/workspaces
# The -k flag mimics the InsecureSkipVerify behavior

Blue Team (Defense & Detection)

Detection:

• Monitor for connections from aibridgeproxyd to unexpected IP addresses or domains.
• Look for TLS handshake failures or certificate warnings in proxy logs.
• Use network monitoring to detect ARP spoofing or rogue DHCP servers.

Mitigation:

• Apply the patch immediately (upgrade to 2.32.7, 2.33.8, or 2.34.2).
• If patching is not possible, ensure the Coder access URL uses a trusted certificate and restrict network access between the AI Bridge Proxy and Coder server to loopback or a dedicated VLAN with mTLS.
• Implement network segmentation to prevent MITM attacks.

Indicators of Compromise (IOCs)

• Network: TLS connections from aibridgeproxyd to the Coder access URL that use weak cipher suites or self-signed certificates.
• Logs: Proxy logs showing InsecureSkipVerify warnings or TLS handshake errors.
• Process: aibridgeproxyd binary with a hash matching vulnerable versions.
• File: Configuration files where InsecureSkipVerify is set to true.

File Hashes (example, not actual):

• aibridgeproxyd (v2.30.0): sha256:abc123...
• aibridgeproxyd (v2.32.7): sha256:def456...

Detection Engineering

YARA Rule

rule CVE_2026_55436_InsecureSkipVerify {
    meta:
        description = "Detects vulnerable aibridgeproxyd binary with InsecureSkipVerify set to true"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2026-55436"
    strings:
        $s1 = "InsecureSkipVerify" ascii wide nocase
        $s2 = "true" ascii wide nocase
        $s3 = "aibridgeproxyd" ascii wide nocase
    condition:
        all of them
}

Sigma Rule

title: CVE-2026-55436 - AI Bridge Proxy Insecure TLS Connection
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects outbound TLS connections from aibridgeproxyd that may be using insecure certificate validation
author: Valters IT
date: 2025-04-10
logsource:
    category: network_connection
    product: windows
    service: sysmon
detection:
    selection:
        Image|endswith: '\aibridgeproxyd.exe'
        DestinationPort: 443
        Initiated: true
    filter:
        - DestinationHostname: '*.coder.example.com'  # Adjust to your domain
    condition: selection and not filter
falsepositives:
    - Legitimate connections to trusted Coder servers
level: high
tags:
    - attack.t1557.001
    - cve.2026.55436

Suricata Rule

alert tls $HOME_NET any -> $EXTERNAL_NET 443 (msg:"CVE-2026-55436 - AI Bridge Proxy Insecure TLS Connection"; flow:to_server; tls.version:<TLSv1.2; tls.cert_issuer:"CN=*"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Coder to versions 2.32.7, 2.33.8, or 2.34.2 (or later).
2. If upgrade is not possible, configure an upstream proxy with proper TLS verification to force the secure transport path.
3. Ensure the Coder access URL uses a certificate from a trusted CA.

Long-term Measures:

• Implement network segmentation to isolate the AI Bridge Proxy and Coder server.
• Use mutual TLS (mTLS) for all internal communications.
• Regularly audit TLS configurations in all components.
• Monitor for any use of InsecureSkipVerify in Go binaries.

Workaround:

• Co-locate the AI Bridge Proxy and Coder server on the same host (loopback) to eliminate the network path.

Valters IT