CVE-2026-55429 coder CVE debrief

Who should care

Users of Coder, especially those with elevated access as template authors or external provisioner operators, should be aware of this vulnerability and take steps to ensure they are running a patched version. This includes reviewing and limiting elevated access to Coder and monitoring for suspicious activity in Coder environments.

Technical summary

The vulnerability exists due to the `UpsertWorkspaceApp` function overwriting an existing app's `agent_id` on a primary-key conflict and the `insertAgentApp` function accepting an app ID from the provisioner's `CompleteJob` payload without verifying it belongs to the workspace being built. The `CompleteJob` runs under `dbauthz.AsProvisionerd`, bypassing the authorization layer and allowing cross-workspace upsert. Exploitation requires elevated access as a template author or external provisioner operator.

Defensive priority

High priority should be given to patching Coder installations, especially in environments where elevated access is common. This includes reviewing compensating controls for exposed systems while remediation is scheduled and verified.

Recommended defensive actions

• Patch Coder to version 2.29.7, 2.32.7, 2.33.8, or 2.34.2
• Review and limit elevated access to Coder
• Monitor for suspicious activity in Coder environments
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record was published on 2026-07-08T00:16:33.597Z and has not been modified since then. The NVD entry is currently 8.7 HIGH. The vulnerability exists in Coder, a tool for provisioning remote development environments via Terraform. The CVE record was published on 2026-07-08T00:16:33.597Z and has not been modified since then. The NVD entry is currently 8.7 HIGH. Exploitation requires elevated access as a template author or external provisioner operator.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.