Vulnerability · Published Jul 8, 2026 · Assigned by GitHub_M

CVE-2026-55430Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access

Medium 5.8

In plain English

A medium-severity insufficient verification of data authenticity in coder from coder. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 11% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.8Medium

Exploit odds (30 days)0.2%top 89.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, the workspace app proxy resolves the target app from `httpapi.RequestHost()` which prefers the `X-Forwarded-Host` header over the real `Host` header. No middleware strips `X-Forwarded-Host` before routing and the header is not browser-forbidden so client-side JavaScript can set it on `fetch()` calls. Practical exploitation requires subdomain app routing (wildcard hostname) enabled, a victim who visits the attacker's shared app and a deployment whose upstream proxy does not strip `X-Forwarded-Host`. The fix in versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2 trusts `X-Forwarded-Host` only from configured trusted proxies and otherwise resolves the routing host from the verified request host. As a workaround, place an upstream reverse proxy that strips or overwrites `X-Forwarded-Host` on untrusted requests.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Go	github.com/coder/coder	no fix listed	GO-2026-5917
Go	github.com/coder/coder/v2	2.34.2	GHSA-5g4w-3vw9-478w
Go	github.com/coder/coder/v2	2.33.8	GHSA-5g4w-3vw9-478w
Go	github.com/coder/coder/v2	2.32.7	GHSA-5g4w-3vw9-478w
Go	github.com/coder/coder/v2	2.29.17	GHSA-5g4w-3vw9-478w
Go	github.com/coder/coder/v2	2.29.17, 2.32.7, 2.33.8, 2.34.2	GO-2026-5917

Affected products (as reported)

Vendor	Product	Versions
coder	coder	>= 2.34.0, < 2.34.2>= 2.33.0, < 2.33.8>= 2.30.0, < 2.32.7< 2.29.17

Weakness: CWE-345, CWE-441 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N

References

https://github.com/coder/coder/security/advisories/GHSA-5g4w-3vw9-478w x_refsource_CONFIRM
https://github.com/coder/coder/pull/26204 x_refsource_MISC
https://github.com/coder/coder/releases/tag/v2.29.17 x_refsource_MISC
https://github.com/coder/coder/releases/tag/v2.32.7 x_refsource_MISC
https://github.com/coder/coder/releases/tag/v2.33.8 x_refsource_MISC
https://github.com/coder/coder/releases/tag/v2.34.2 x_refsource_MISC