CVE-2026-55430

Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access

Published Jul 8, 2026 CVSS 3.1 · 5.8 Medium EPSS < 1% KEV · Not listed

Description

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, the workspace app proxy resolves the target app from `httpapi.RequestHost()` which prefers the `X-Forwarded-Host` header over the real `Host` header. No middleware strips `X-Forwarded-Host` before routing and the header is not browser-forbidden so client-side JavaScript can set it on `fetch()` calls. Practical exploitation requires subdomain app routing (wildcard hostname) enabled, a victim who visits the attacker's shared app and a deployment whose upstream proxy does not strip `X-Forwarded-Host`. The fix in versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2 trusts `X-Forwarded-Host` only from configured trusted proxies and otherwise resolves the routing host from the verified request host. As a workaround, place an upstream reverse proxy that strips or overwrites `X-Forwarded-Host` on untrusted requests.

Analysis

Technical impact

The vulnerability allows an attacker to manipulate the X-Forwarded-Host HTTP header in client-side JavaScript, causing the workspace app proxy to resolve the target application based on this header without stripping or validating it. A malicious user can steer the proxy to route traffic to an arbitrary subdomain of the same deployment. This behavior can cause a user on one tenant’s application to read or modify data that belongs to another tenant, compromising confidentiality and potentially integrity. The weakness is represented by missing input validation (CWE‑345) and inappropriate access control (CWE‑441).

Affected Systems

The product affected is Coder by Coder. Versions earlier than 2.29.7, 2.32.7, 2.33.8, and 2.34.2 are vulnerable. Deployments using any of these vulnerable versions with subdomain app routing enabled are at risk.

Risk and Exploitability

The CVSS score of 5.8 reflects a moderate severity. The EPSS score of <1% indicates a very low but non‑zero likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Practical exploitation requires three conditions: subdomain app routing must be enabled; a victim must visit an attacker‑controlled shared application; and the upstream proxy in the chain must not strip the X-Forwarded-Host header. The attack vector is remote and occurs via a malicious client‑side script that sets the header, without needing local privileges. Once executed the attacker can read or modify cross‑tenant data within the same deployment.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

coder

affected

Version	Status	Constraints
`>= 2.34.0, < 2.34.2`	affected	—
`>= 2.33.0, < 2.33.8`	affected	—
`>= 2.30.0, < 2.32.7`	affected	—
`< 2.29.17`	affected	—

Configuration 1 [-]

OR	cpe:2.3:a:coder:coder::::::go::*
	cpe:2.3:a:coder:coder::::::go::*
	cpe:2.3:a:coder:coder::::::go::*
	cpe:2.3:a:coder:coder::::::go::*

No data.

Vendor Product Versions

Coder

Version	Status	Scheme	Platform
`[2.34.0,2.34.2)`	affected	semver	—
`[2.33.0,2.33.8)`	affected	semver	—
`[2.30.0,2.32.7)`	affected	semver	—
`[0,2.29.17)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade Coder to at least version 2.29.7 (or the corresponding newer releases 2.32.7, 2.33.8, or 2.34.2) to apply the official fix.
Deploy an upstream reverse proxy that strips or overwrites X-Forwarded-Host on untrusted requests.
As a temporary containment step, disable or restrict subdomain app routing until the patch or reverse‑proxy workaround is in place.

Generated by OpenCVE AI on August 1, 2026 at 16:59 UTC.

Tracking

Advisories

Source	ID	Title
Github GHSA	GHSA-5g4w-3vw9-478w	Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required Low

Scope Changed

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.208% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/coder/coder/pull/26204
https://github.com/coder/coder/releases/tag/v2.29.17
https://github.com/coder/coder/releases/tag/v2.32.7
https://github.com/coder/coder/releases/tag/v2.33.8
https://github.com/coder/coder/releases/tag/v2.34.2
https://github.com/coder/coder/security/advisories/GHSA-5g4w-3vw9-478w

History

Jul 8, 2026 6:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jul 8, 2026 2:45 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Coder Coder coder
Vendors & Products		Coder Coder coder

Jul 8, 2026 1:00 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, the workspace app proxy resolves the target app from `httpapi.RequestHost()` which prefers the `X-Forwarded-Host` header over the real `Host` header. No middleware strips `X-Forwarded-Host` before routing and the header is not browser-forbidden so client-side JavaScript can set it on `fetch()` calls. Practical exploitation requires subdomain app routing (wildcard hostname) enabled, a victim who visits the attacker's shared app and a deployment whose upstream proxy does not strip `X-Forwarded-Host`. The fix in versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2 trusts `X-Forwarded-Host` only from configured trusted proxies and otherwise resolves the routing host from the verified request host. As a workaround, place an upstream reverse proxy that strips or overwrites `X-Forwarded-Host` on untrusted requests.
Title		Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access
Weaknesses		CWE-345 CWE-441
References		https://github.com/coder/coder/pull/26204 https://github.com/coder/coder/releases/tag/v2.29.17 https://github.com/coder/coder/releases/tag/v2.32.7 https://github.com/coder/coder/releases/tag/v2.33.8 https://github.com/coder/coder/releases/tag/v2.34.2 https://github.com/coder/coder/security/advisories/GHSA-5g4w-3vw9-478w
Metrics		cvssV3_1 `{'score': 5.8, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N'}`