Vulnerability · Published Jul 7, 2026 · Assigned by GitHub_M

CVE-2026-55435Suspended Coder users retain access to AI Bridge LLM proxy endpoints

Medium 5.4

In plain English

A medium-severity incorrect authorization in coder from coder. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.4Medium

Exploit odds (30 days)0.3%top 75.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Coder allows organizations to provision remote development environments via Terraform. Starting in version 2.30.0 and prior to versions 2.32.7, 2.33.8, and 2.34.2, AI Bridge proxy endpoints authenticate via `Server.IsAuthorized` in `coderd/aibridgedserver`, which validates key format, expiry, secret and deleted or system users but does not check whether the account is suspended. Because suspension does not revoke existing API keys, a suspended user's unexpired token keeps working. Practical impact is limited to already-issued API keys of suspended users until those keys are deleted. Versions 2.32.7, 2.33.8, and 2.34.2 patch the issue. As a workaround, on suspension, delete the user's API keys via `DELETE /api/v2/users/{user}/keys`.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Go	github.com/coder/coder	no fix listed	GO-2026-5925
Go	github.com/coder/coder/v2	2.32.7, 2.33.8, 2.34.2	GO-2026-5925
Go	github.com/coder/coder/v2	2.34.2	GHSA-wqxv-w64v-5wh6
Go	github.com/coder/coder/v2	2.33.8	GHSA-wqxv-w64v-5wh6
Go	github.com/coder/coder/v2	2.32.7	GHSA-wqxv-w64v-5wh6

Affected products (as reported)

Vendor	Product	Versions
coder	coder	>= 2.34.0, < 2.34.2>= 2.33.0, < 2.33.8>= 2.30.0, < 2.32.7

Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

References

https://github.com/coder/coder/security/advisories/GHSA-wqxv-w64v-5wh6 x_refsource_CONFIRM
https://github.com/coder/coder/pull/26164 x_refsource_MISC
https://github.com/coder/coder/pull/26173 x_refsource_MISC
https://github.com/coder/coder/commit/0d2c9f904a8b75b888140fcc8fbf4633660cc787 x_refsource_MISC
https://github.com/coder/coder/releases/tag/v2.32.7 x_refsource_MISC
https://github.com/coder/coder/releases/tag/v2.33.8 x_refsource_MISC
https://github.com/coder/coder/releases/tag/v2.34.2 x_refsource_MISC