Coder's sub-agent app registration bypasses template port-sharing policy enforcement
Published Jul 8, 2026
5.4
MEDIUMCVSS 3.1
EPSS 0.32%
Description
Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, the `CreateSubAgent` RPC did not validate a requested app sharing level against the template's `MaxPortSharingLevel` before persisting workspace apps, letting a workspace owner exceed the administrator's configured maximum. Exploitation requires the ability to register sub-agent apps in a workspace the attacker controls. The fix in versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2clamps the sub-agent app sharing level to the template's `MaxPortSharingLevel`. As a workaround, disable wildcard app hostnames (`CODER_WILDCARD_ACCESS_URL`) to block subdomain-based app routing.
Affected products
-
- Version < 2.29.17StatusaffectedConstraints-
- Version >= 2.30.0, < 2.32.7StatusaffectedConstraints-
- Version >= 2.33.0, < 2.33.8StatusaffectedConstraints-
- Version >= 2.34.0, < 2.34.2StatusaffectedConstraints-
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
No data.
No Red Hat product state for this CVE.
github.com/coder/coder/v2
Go
Introduced 2.34.0 Fixed 2.34.2github.com/coder/coder/v2
Go
Introduced 2.33.0 Fixed 2.33.8github.com/coder/coder/v2
Go
Introduced 2.30.0 Fixed 2.32.7github.com/coder/coder/v2
Go
Introduced 0 Fixed 2.29.17github.com/coder/coder
Go
Introduced 0 Fixed not fixed
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | github.com/coder/coder/v2 | 2.34.0 | 2.34.2 |
| Go | github.com/coder/coder/v2 | 2.33.0 | 2.33.8 |
| Go | github.com/coder/coder/v2 | 2.30.0 | 2.32.7 |
| Go | github.com/coder/coder/v2 | 0 | 2.29.17 |
| Go | github.com/coder/coder | 0 | not fixed |
Remediation
No remediation recorded yet.
References (7)
- https://github.com/advisories/GHSA-x9qq-2qh5-8rxf Advisory
- https://github.com/coder/coder/pull/26061 x_refsource_MISCIssue TrackingPatch
- https://github.com/coder/coder/releases/tag/v2.29.17 x_refsource_MISCRelease Notes
- https://github.com/coder/coder/releases/tag/v2.32.7 x_refsource_MISCRelease Notes
- https://github.com/coder/coder/releases/tag/v2.33.8 x_refsource_MISCRelease Notes
- https://github.com/coder/coder/releases/tag/v2.34.2 x_refsource_MISCRelease Notes
- https://github.com/coder/coder/security/advisories/GHSA-x9qq-2qh5-8rxf x_refsource_CONFIRMPatchVendor Advisory
| Link | Providers | Tags |
|---|---|---|
| https://github.com/advisories/GHSA-x9qq-2qh5-8rxf | Advisory | |
| https://github.com/coder/coder/pull/26061 | x_refsource_MISCIssue TrackingPatch | |
| https://github.com/coder/coder/releases/tag/v2.29.17 | x_refsource_MISCRelease Notes | |
| https://github.com/coder/coder/releases/tag/v2.32.7 | x_refsource_MISCRelease Notes | |
| https://github.com/coder/coder/releases/tag/v2.33.8 | x_refsource_MISCRelease Notes | |
| https://github.com/coder/coder/releases/tag/v2.34.2 | x_refsource_MISCRelease Notes | |
| https://github.com/coder/coder/security/advisories/GHSA-x9qq-2qh5-8rxf | x_refsource_CONFIRMPatchVendor Advisory |
Change history (0)
No recorded changes yet.