Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access

Description

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, the workspace app proxy resolves the target app from `httpapi.RequestHost()` which prefers the `X-Forwarded-Host` header over the real `Host` header. No middleware strips `X-Forwarded-Host` before routing and the header is not browser-forbidden so client-side JavaScript can set it on `fetch()` calls. Practical exploitation requires subdomain app routing (wildcard hostname) enabled, a victim who visits the attacker's shared app and a deployment whose upstream proxy does not strip `X-Forwarded-Host`. The fix in versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2 trusts `X-Forwarded-Host` only from configured trusted proxies and otherwise resolves the routing host from the verified request host. As a workaround, place an upstream reverse proxy that strips or overwrites `X-Forwarded-Host` on untrusted requests.

Scores

EPSS (exploitation in 30 days)

0.21% · top 89% of all CVEs (6 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.8.

Weakness

• CWE-345: Insufficient Verification of Data Authenticity (opens in a new tab)All about CWE-345 and its CVEs
• CWE-441: Unintended Proxy or Intermediary ('Confused Deputy') (opens in a new tab)All about CWE-441 and its CVEs

Affected products

• coder · coder

  • affected >= 2.34.0, < 2.34.2
  • affected >= 2.33.0, < 2.33.8
  • affected >= 2.30.0, < 2.32.7
  • affected < 2.29.17

Affected packages

From reviewed advisories of the GitHub Advisory Database.

• Gogithub.com/coder/coder/v2GHSA-5g4w-3vw9-478w (opens in a new tab)

References (6)

• https://github.com/coder/coder/security/advisories/GHSA-5g4w-3vw9-478w (opens in a new tab)x_refsource_CONFIRM
• https://github.com/coder/coder/pull/26204 (opens in a new tab)x_refsource_MISC
• https://github.com/coder/coder/releases/tag/v2.29.17 (opens in a new tab)x_refsource_MISC
• https://github.com/coder/coder/releases/tag/v2.32.7 (opens in a new tab)x_refsource_MISC
• https://github.com/coder/coder/releases/tag/v2.33.8 (opens in a new tab)x_refsource_MISC
• https://github.com/coder/coder/releases/tag/v2.34.2 (opens in a new tab)x_refsource_MISC

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisory GHSA-5g4w-3vw9-478w (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2026-55430](https://trackcve.app/badge/CVE-2026-55430.svg)](https://trackcve.app/cve/CVE-2026-55430)

Record last updated 8 Jul 2026, 17:10 UTC.