PT-2026-56077 · Coder · Coder

Published 2026-07-06 · Updated 2026-07-08 · CVE-2026-55433

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions Coder versions prior to 2.29.17 Coder versions prior to 2.32.7 Coder versions prior to 2.33.8 Coder versions prior to 2.34.2

Description An authorization bypass exists in the devcontainer recreate endpoint. The endpoint relied on route middleware that only verified ActionRead permissions on the workspace, failing to perform an ActionUpdate check before triggering a destructive rebuild. An authenticated principal with low-privilege read-only access, such as a Template Admin or Org Template Admin, could exploit this to recreate a devcontainer. This action destroys uncommitted in-container state and can lead to a denial of service if performed repeatedly.

Recommendations Update to version 2.29.17 Update to version 2.32.7 Update to version 2.33.8 Update to version 2.34.2

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-55433

GHSA-JQJ2-X4C5-JFXM

GO-2026-5922

Affected Products

Coder

References · 11

• https://osv.dev/vulnerability/GO-2026-5922 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-jqj2-x4c5-jfxm · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-55433 · Security Note
• https://github.com/coder/coder/releases/tag/v2.33.8 · Note
• https://github.com/coder/coder/releases/tag/v2.32.7 · Note
• https://github.com/coder/coder/releases/tag/v2.34.2 · Note
• https://github.com/coder/coder/releases/tag/v2.29.17 · Note
• https://github.com/coder/coder/security/advisories/GHSA-jqj2-x4c5-jfxm · Note
• https://github.com/coder/coder/pull/25812 · Note
• https://github.com/coder/coder · Note
• https://twitter.com/CVEnew/status/2074728395552805167 · Twitter Post