CVE-2026-55429
Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID
- Published
- Updated
- Reserved
- Assigned by
- GitHub_M
Description
Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, `UpsertWorkspaceApp` overwrites an existing app's `agent_id` on a primary-key conflict and `insertAgentApp` accepts the app ID from the provisioner's `CompleteJob` payload without verifying it belongs to the workspace being built. `CompleteJob` runs under `dbauthz.AsProvisionerd` so the authorization layer does not block the cross-workspace upsert. Exploitation requires elevated access as a template author or external provisioner operator. The fix in versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2 verifies that any existing `workspace_apps` row matching the supplied ID belongs to the workspace being built and rejects cross-workspace agent reassignment. No known workarounds are available.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| GitHub_MCNA (assigner) | 3.1 | High8.7 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N |
| NVDNVD · Analyzed | 3.1 | High8.7 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N |
- EPSS (exploitation in 30 days)
- 0.51% · top 56% of all CVEs (6 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.7.
Weakness
Affected products
Affected packages
From reviewed advisories of the GitHub Advisory Database.
- Gogithub.com/coder/coder/v2GHSA-9rjw-3gwp-f59v (opens in a new tab)
References (6)
- https://github.com/coder/coder/security/advisories/GHSA-9rjw-3gwp-f59v (opens in a new tab)x_refsource_CONFIRM
- https://github.com/coder/coder/pull/26103 (opens in a new tab)x_refsource_MISC
- https://github.com/coder/coder/releases/tag/v2.29.17 (opens in a new tab)x_refsource_MISC
- https://github.com/coder/coder/releases/tag/v2.32.7 (opens in a new tab)x_refsource_MISC
- https://github.com/coder/coder/releases/tag/v2.33.8 (opens in a new tab)x_refsource_MISC
- https://github.com/coder/coder/releases/tag/v2.34.2 (opens in a new tab)x_refsource_MISC
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisory GHSA-9rjw-3gwp-f59v (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2026-55429)Record last updated .