CVE-2026-55431 coder CVE debrief

Who should care

Users of Coder versions prior to 2.29.7, 2.32.7, 2.33.8, and 2.34.2 should be aware of this vulnerability and take steps to mitigate it. This includes avoiding running `coder open app` for untrusted workspaces, updating to a patched version, and monitoring for suspicious activity related to external app URLs. Operators, platform administrators, vulnerability management teams, and security teams should review the official advisory and assess their exposure.

Technical summary

The vulnerability exists in the `coder open app` command, which opens external workspace-app URLs without proper validation of the scheme or host. An attacker who controls the external app definition can exploit this by including the `$SESSION_TOKEN` placeholder, which the CLI replaces with the user's real session token before opening the URL. This allows for potential unauthorized access. The fix involves adding a URL-scheme allowlist and restricting `$SESSION_TOKEN` substitution to trusted destinations like the web frontend.

Defensive priority

High

Recommended defensive actions

• Update Coder to version 2.29.7, 2.32.7, 2.33.8, or 2.34.2 or later
• Avoid running `coder open app` for untrusted workspaces
• Monitor for suspicious activity related to external app URLs
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and source item provide details about the vulnerability and its fix. The NVD entry and GitHub references offer additional context and patched versions. To verify, defenders should review the official advisory, assess affected deployments, and monitor for suspicious activity related to external app URLs. Evidence is limited, and further verification is required to confirm the scope of the vulnerability.

Official resources