CVE-2026-55433 PUBLISHED

Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers

Assigner: GitHub_M
Reserved: 16.06.2026 Published: 08.07.2026 Updated: 08.07.2026

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, the devcontainer recreate endpoint relied on route middleware that checked only ActionRead on the workspace and, unlike the sibling delete endpoint, performed no ActionUpdate check before triggering the destructive rebuild. Exploitation requires an existing low-privilege role with access to the target workspace. The fix in versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2 adds an explicit ActionUpdate authorization check before the agent is dialed like the delete endpoint. No known workarounds are available.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
CVSS Score: 5.4

Product Status

Vendor coder
Product coder
Versions
  • Version >= 2.34.0, < 2.34.2 is affected
  • Version >= 2.33.0, < 2.33.8 is affected
  • Version >= 2.30.0, < 2.32.7 is affected
  • Version < 2.29.17 is affected

References

Problem Types

  • CWE-862: Missing Authorization CWE