Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps

Description

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, `coder open app` opens external workspace-app URLs without validating the scheme or host. When an external app URL contains the `$SESSION_TOKEN` placeholder the CLI replaces it with the user's real session token before handing the URL to the OS open handler. Practical exploitation requires the victim to run `coder open app` against a workspace whose external app definition the attacker controls. Only a malicious template author can control external app URLs. The fix in versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2 applies a URL-scheme allowlist in the CLI and limits `$SESSION_TOKEN` substitution to trusted destinations like the web frontend. As a workaround, avoid running `coder open app` for untrusted workspaces.

Scores

EPSS (exploitation in 30 days)

0.34% · top 73% of all CVEs (6 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: no · Technical impact: total

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.7.

Weakness

• CWE-522: Insufficiently Protected Credentials (opens in a new tab)All about CWE-522 and its CVEs
• CWE-601: URL Redirection to Untrusted Site ('Open Redirect') (opens in a new tab)All about CWE-601 and its CVEs

Affected products

• coder · coder

  • affected >= 2.34.0, < 2.34.2
  • affected >= 2.33.0, < 2.33.8
  • affected >= 2.30.0, < 2.32.7
  • affected < 2.29.17

Affected packages

From reviewed advisories of the GitHub Advisory Database.

• Gogithub.com/coder/coder/v2GHSA-v54h-cp2w-9x4g (opens in a new tab)

References (6)

• https://github.com/coder/coder/security/advisories/GHSA-v54h-cp2w-9x4g (opens in a new tab)x_refsource_CONFIRM
• https://github.com/coder/coder/pull/26146 (opens in a new tab)x_refsource_MISC
• https://github.com/coder/coder/releases/tag/v2.29.17 (opens in a new tab)x_refsource_MISC
• https://github.com/coder/coder/releases/tag/v2.32.7 (opens in a new tab)x_refsource_MISC
• https://github.com/coder/coder/releases/tag/v2.33.8 (opens in a new tab)x_refsource_MISC
• https://github.com/coder/coder/releases/tag/v2.34.2 (opens in a new tab)x_refsource_MISC

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisory GHSA-v54h-cp2w-9x4g (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2026-55431](https://trackcve.app/badge/CVE-2026-55431.svg)](https://trackcve.app/cve/CVE-2026-55431)

Record last updated 8 Jul 2026, 13:57 UTC.