Coder < 2.29.17 - CraftedSignal Threat Feed

Coder Tailnet Vulnerability (CVE-2026-55428) Leads to Route Hijacking

hello@craftedsignal.io — Mon, 06 Jul 2026 21:04:20 +0000

A critical vulnerability, CVE-2026-55428, has been identified in Coder's tailnet coordinator, impacting all supported versions of Coder, including 2.34, 2.33, 2.32, and 2.29 (ESR) prior to their patched releases. The flaw stems from insufficient validation of agent-supplied AllowedIPs, allowing a malicious Coder agent to advertise arbitrary network prefixes. This enables the agent to hijack network traffic intended for other agents, intercepting web terminal and workspace application communications, and potentially serving spoofed content. Exploitation requires an authenticated user with a running workspace and a modified agent binary. This vulnerability could lead to significant data exposure, credential theft, or further compromise of an organization's development environment. The issue was independently disclosed by Anthropic's Security Team.

Attack Chain

An authenticated user gains access to a Coder environment and initiates a workspace.
The authenticated user modifies their Coder agent binary to include malicious functionality capable of manipulating AllowedIPs advertisements.
The malicious Coder agent connects to the Coder tailnet coordinator.
The malicious agent advertises arbitrary AllowedIPs prefixes, including the tailnet address of a target victim agent, to the coordinator.
Due to the vulnerability (CVE-2026-55428), the Coder coordinator, lacking proper validation, forwards these unverified AllowedIPs verbatim to other tunnel peers within the tailnet.
The other tunnel peers, receiving the malicious AllowedIPs configuration, install them into their WireGuard peer configurations, effectively re-routing traffic intended for the victim agent to the malicious agent.
The malicious agent then intercepts web terminal and workspace application traffic from the victim and can serve spoofed content, facilitating data exfiltration, credential harvesting, or further exploitation.

Impact

Successful exploitation of CVE-2026-55428 allows an attacker to perform a sophisticated Man-in-the-Middle attack within the Coder tailnet. This enables the interception of sensitive web terminal and workspace application traffic from other users or agents, potentially leading to the theft of credentials, session tokens, or proprietary data. Furthermore, the ability to serve spoofed content means attackers could phish users, deliver malicious updates, or otherwise compromise the integrity of the development environment. The vulnerability affects critical internal communication pathways, posing a severe risk to intellectual property and operational security for organizations utilizing vulnerable Coder versions.

Recommendation

Immediately upgrade all affected Coder installations to the patched versions: Coder v2.34.2, v2.33.8, v2.32.7, or v2.29.17 to remediate CVE-2026-55428.
Monitor Coder coordinator logs for any agents advertising unexpected AllowedIPs prefixes, as this could indicate an attempted or successful exploitation.
Review network configurations to ensure that only trusted and authenticated agents are permitted to interact with the Coder tailnet coordinator.

Coder OIDC email_verified Type Coercion Bypass (CVE-2026-55076)

hello@craftedsignal.io — Mon, 06 Jul 2026 20:58:08 +0000

A critical vulnerability, tracked as CVE-2026-55076, has been identified in Coder's platform, affecting versions prior to 2.34.2, 2.33.8, 2.32.7, and 2.29.17. The flaw resides in how Coder's OpenID Connect (OIDC) callback processes the email_verified claim from an Identity Provider (IdP). Instead of robust type coercion, Coder used a direct Go bool type assertion. This meant that if an IdP returned email_verified as a non-boolean value (e.g., the string "false") or omitted the claim entirely, Coder's system would incorrectly default to treating the email as verified. This misinterpretation, combined with an unconditional email-based account fallback feature, created a pathway for unauthenticated account takeover, enabling attackers to gain full control over a victim's existing Coder account without requiring prior authentication.

Attack Chain

Initial Account Registration: The victim legitimately registers and creates an account on a Coder instance, likely linked to their corporate email address.
Attacker IdP Setup: The attacker registers an OpenID Connect (OIDC) Identity Provider (IdP) and configures it to impersonate the victim's email address.
IdP Claim Manipulation: The attacker's IdP is configured to either omit the email_verified claim or return it as a non-boolean string (e.g., "false") during an authentication response.
OIDC Authentication Attempt: The attacker initiates an OIDC login attempt to the target Coder instance, selecting their malicious IdP.
Type Coercion Bypass: Coder's OIDC callback receives the IdP response and, due to the vulnerability, incorrectly processes the email_verified claim (or its absence) as verified.
Account Fallback Activation: Coder's unconditional email-based account fallback mechanism matches the (falsely) verified email from the IdP to the victim's existing Coder account.
Session Establishment: Coder grants the attacker a valid session for the victim's account, resulting in a full account takeover.

Impact

Successful exploitation of CVE-2026-55076 allows for complete account takeover of any existing Coder user. An attacker does not need prior authentication to the Coder instance. This means sensitive data, project code, and system configurations associated with the compromised account become fully accessible to the attacker. While no specific victim count or targeted sector is provided, Coder is widely used for development environments, meaning a wide range of organizations and intellectual property could be at risk. The direct result is unauthorized access to development infrastructure and potential lateral movement within an organization's ecosystem.

Recommendation

Patch CVE-2026-55076 immediately by upgrading your Coder instance to version 2.34.2, 2.33.8, 2.32.7, or 2.29.17 as described in the brief.
Review IdP configurations: Ensure your Identity Provider (IdP) for OIDC returns the email_verified claim as a native JSON boolean (true or false) to mitigate risks in case of other application vulnerabilities.

Coder OIDC Account Takeover Vulnerabilities (CVE-2026-55075)

hello@craftedsignal.io — Mon, 06 Jul 2026 20:57:10 +0000

CVE-2026-55075 describes two critical vulnerabilities discovered in Coder's OpenID Connect (OIDC) login process, publicly disclosed in July 2026 by Anthropic's Security Team. The first flaw involves email-based user matching, which would link a Coder account to an OIDC identity based solely on a matching email address, even if an existing link to a different Identity Provider (IdP) subject was present. The second flaw permits bypassing the email_verified claim, where the system incorrectly treated an absent or non-boolean email_verified claim as verified. Chaining these issues allows an attacker controlling a matching email address at the OIDC provider to log in as a victim Coder user, gaining full access to their development workspaces, templates, and resources. This vulnerability specifically targets Coder installations configured with OIDC authentication, affecting versions prior to v2.29.17 and specific ranges within the 2.30.x, 2.33.x, and 2.34.x series.

Attack Chain

Attacker identifies a Coder instance configured to use OIDC authentication.
Attacker discovers a victim's email address registered with a Coder account on the target instance.
Attacker registers or takes control of an account at the configured OIDC provider using the victim's email address.
Attacker initiates an OIDC login flow to the vulnerable Coder instance, authenticating via their controlled OIDC provider account.
The OIDC provider issues an ID Token to the attacker, where the email_verified claim is either absent or has a non-boolean value.
The vulnerable Coder instance processes the ID Token, but due to CVE-2026-55075, it bypasses the email_verified check and performs user matching based solely on the email address.
The Coder instance incorrectly links the attacker's OIDC identity to the victim's existing Coder account.
The attacker is granted full access to the victim's Coder account, including workspaces, templates, and resources.

Impact

Successful exploitation of CVE-2026-55075 leads to complete account takeover within the affected Coder environment. An attacker gains full administrative access to the victim's Coder workspaces, templates, and any associated resources, including access to sensitive code, development environments, and potentially integrated systems. This could lead to data exfiltration, intellectual property theft, code manipulation, or further lateral movement within an organization's development infrastructure. The prerequisites for this attack include the use of OIDC authentication, the attacker's ability to control an email address at the IdP matching the victim's Coder account, and the victim's account not already being linked to a different IdP subject.

Recommendation

Immediately patch all Coder installations to the recommended versions to address CVE-2026-55075: v2.34.2, v2.33.8, v2.32.7, or v2.29.17.
As a temporary workaround for CVE-2026-55075, configure your OIDC provider to disallow self-registration of user accounts.
As an additional temporary workaround for CVE-2026-55075, ensure your OIDC provider is configured to strictly require email verification before issuing ID Tokens for user accounts.