CVE-2026-55435

Katalog CVE

CVSS 5.4 · Medium EPSS 0,32%

Kerentanan Incorrect Authorization pada coder. Skor CVSS 3.1 5.4 (Medium) menurut github.com.

Deskripsi (NVD)

Coder allows organizations to provision remote development environments via Terraform. Starting in version 2.30.0 and prior to versions 2.32.7, 2.33.8, and 2.34.2, AI Bridge proxy endpoints authenticate via `Server.IsAuthorized` in `coderd/aibridgedserver`, which validates key format, expiry, secret and deleted or system users but does not check whether the account is suspended. Because suspension does not revoke existing API keys, a suspended user's unexpired token keeps working. Practical impact is limited to already-issued API keys of suspended users until those keys are deleted. Versions 2.32.7, 2.33.8, and 2.34.2 patch the issue. As a workaround, on suspension, delete the user's API keys via `DELETE /api/v2/users/{user}/keys`.

Rincian

Terbit di NVD

7 Juli 2026

Terakhir diubah

9 Juli 2026

Status NVD

Analyzed

CVSS 3.1

5.4 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-863: Incorrect Authorization

EPSS (30 hari)

0,32% peluang dieksploitasi; lebih tinggi dari 22,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/coder/coder/security/advisories/GHSA-wqxv-w64v-5wh6 patch · advisory vendor
• https://github.com/coder/coder/commit/0d2c9f904a8b75b888140fcc8fbf4633660cc787 patch
• https://github.com/coder/coder/pull/26164 issue tracking · patch
• https://github.com/coder/coder/pull/26173 issue tracking · patch
• https://github.com/coder/coder/releases/tag/v2.32.7 release notes
• https://github.com/coder/coder/releases/tag/v2.33.8 release notes
• https://github.com/coder/coder/releases/tag/v2.34.2 release notes