Coder's CreateSubAgent RPC allowed a user with the ability to register sub‑agent apps in a workspace to create apps that bypassed the workspace template’s MaxPortSharingLevel, enabling the owner of the workspace to expose more ports than an administrator intended. This flaw aligns with CWE‑862 and results in unauthorized port sharing, potentially exposing services that should be restricted to a narrower set of ports. The vulnerability can be exploited without compromising the entire platform; it only requires authorized access to register sub‑agent apps within a target workspace.

platform running versions prior to 2.29.7, 2.32.7, 2.33.8, or 2.34.2 repair releases that enforce the MaxPortSharingLevel constraint for new sub‑agent apps.

The CVSS score of 5.4 indicates a moderate impact, and the EPSS score is less than 1 %, suggesting that the vulnerability is rarely exploited in the wild. It is not listed in the CISA KEV catalog. An attacker must possess workspace‑level permissions sufficient to register sub‑agent apps; the exploit is carried out via the CreateSubAgent RPC within the authenticated workspace context, making the attack vector an authenticated privilege escalation within a managed workspace.