The vulnerability in Coder's workspace application upsert permits a privileged actor to reassign an agent from one workspace to another. This is a CWE‑639 Missing Authorization flaw, where the App endpoint overwrites an existing app's agent_id when a primary‑key conflict occurs, and the insertAgentApp routine accepts an app ID from the provisioner's CompleteJob payload without confirming it belongs to the workspace being built. Because the CompleteJob operation runs with dbauthz.AsProvisionerd permissions, the authorization layer does not detect the cross‑workspace assignment. An attacker with template author or external provisioner operator privileges can bind an agent from a different workspace. This results in privilege escalation and potential compromise of confidentiality, integrity, and availability of the target environment.

Any Coder deployment running a version older than v2.29.7, v2.32.7, v2.33.8, or v2.34.2 is affected. Organizations that use Terraform or other provisioning tools to create remote development environments with Coder must ensure they upgrade accordingly. The flaw targets the coder:coder product and affects all workspaces provisioned by users with elevated provisioner roles.

The flaw carries a CVSS score of 8.7, indicating high severity, while the EPSS score is less than 1%, suggesting low likelihood of widespread exploitation at present. It is not listed in the CISA KEV catalog, so no publicly known exploits exist yet. The likely attack vector involves a malicious or compromised Terraform provider or direct API calls made with provisioner credentials. Once from another workspace, they can run arbitrary commands as that workspace, effectively escalating privileges and controlling the target environment.