Coder up to 2.29.16/2.32.6/2.33.7/2.34.1 Template privilege escalation

Summaryinfo

A vulnerability classified as critical has been found in Coder up to 2.29.16/2.32.6/2.33.7/2.34.1. This vulnerability affects unknown code of the component Template Handler. This manipulation causes an unknown weakness. This vulnerability appears as CVE-2026-55431. There is no available exploit.

Detailsinfo

A vulnerability has been found in Coder up to 2.29.16/2.32.6/2.33.7/2.34.1 and classified as critical. Affected by this vulnerability is some unknown processing of the component Template Handler. The impact remains unknown. The summary by CVE is:

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, `coder open app` opens external workspace-app URLs without validating the scheme or host. When an external app URL contains the `$SESSION_TOKEN` placeholder the CLI replaces it with the user's real session token before handing the URL to the OS open handler. Practical exploitation requires the victim to run `coder open app` against a workspace whose external app definition the attacker controls. Only a malicious template author can control external app URLs. The fix in versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2 applies a URL-scheme allowlist in the CLI and limits `$SESSION_TOKEN` substitution to trusted destinations like the web frontend. As a workaround, avoid running `coder open app` for untrusted workspaces.

The advisory is shared at github.com. This vulnerability is known as CVE-2026-55431 since 06/16/2026. The exploitation appears to be easy. Neither technical details nor an exploit are publicly available.

Upgrading to version 2.29.17, 2.32.7, 2.33.8 or 2.34.2 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Name

• Coder

Version

• 2.29.0
• 2.29.1
• 2.29.2
• 2.29.3
• 2.29.4
• 2.29.5
• 2.29.6
• 2.29.7
• 2.29.8
• 2.29.9
• 2.29.10
• 2.29.11
• 2.29.12
• 2.29.13
• 2.29.14
• 2.29.15
• 2.29.16
• 2.32.0
• 2.32.1
• 2.32.2
• 2.32.3
• 2.32.4
• 2.32.5
• 2.32.6
• 2.33.0
• 2.33.1
• 2.33.2
• 2.33.3
• 2.33.4
• 2.33.5
• 2.33.6
• 2.33.7
• 2.34.0
• 2.34.1

Website

• Product: https://github.com/coder/coder/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion