GHSA-5wg6-jmq2-53pw: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing
Coder's workspace app proxy had a vulnerability in its CORS origin check that could be bypassed via UUID-based subdomain spoofing. This allowed an attacker to craft a subdomain encoding their own workspace UUID and a victim's username, potentially enabling cross-origin requests to the victim's workspace apps if the victim visited the attacker's URL while authenticated. The issue was fixed by validating the subdomain username against the actual workspace owner and basing CORS decisions on the authoritative owner identity. Patched versions are available across multiple release lines. No workarounds exist.
AI Analysis
Technical Summary
The vulnerability in Coder's subdomain-based workspace app proxy allowed bypassing the same-owner CORS check by exploiting how workspace-name subdomains parsed as UUIDs were resolved by ID without verifying that the URL username matched the real owner. The CORS middleware trusted the unverified username in the hostname, enabling an authenticated attacker to craft URLs that could cause a victim's browser to issue credentialed cross-origin fetch requests to the victim's workspace apps and expose sensitive data. The fix enforces validation of the subdomain username against the resolved workspace owner and bases CORS decisions on the verified owner identity. This fix has been backported to all supported release lines.
Potential Impact
An authenticated attacker can trick a victim into visiting a specially crafted URL that abuses the UUID-based subdomain spoofing to bypass CORS origin checks. This enables the attacker’s JavaScript to perform credentialed cross-origin fetch requests to the victim’s workspace apps and read sensitive data accessible through those apps. The vulnerability affects confidentiality but does not impact integrity or availability.
Mitigation Recommendations
Official patches are available and have been backported to all supported release lines: versions 2.34.2, 2.33.8, 2.32.7, and 2.29.17. Users should upgrade to these fixed versions to remediate the vulnerability. No workarounds are available. Applying the official fix fully mitigates the issue by validating the subdomain username against the actual workspace owner and enforcing correct CORS origin checks.
GHSA-5wg6-jmq2-53pw: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing
Description
Coder's workspace app proxy had a vulnerability in its CORS origin check that could be bypassed via UUID-based subdomain spoofing. This allowed an attacker to craft a subdomain encoding their own workspace UUID and a victim's username, potentially enabling cross-origin requests to the victim's workspace apps if the victim visited the attacker's URL while authenticated. The issue was fixed by validating the subdomain username against the actual workspace owner and basing CORS decisions on the authoritative owner identity. Patched versions are available across multiple release lines. No workarounds exist.
CVSS v3.1
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in Coder's subdomain-based workspace app proxy allowed bypassing the same-owner CORS check by exploiting how workspace-name subdomains parsed as UUIDs were resolved by ID without verifying that the URL username matched the real owner. The CORS middleware trusted the unverified username in the hostname, enabling an authenticated attacker to craft URLs that could cause a victim's browser to issue credentialed cross-origin fetch requests to the victim's workspace apps and expose sensitive data. The fix enforces validation of the subdomain username against the resolved workspace owner and bases CORS decisions on the verified owner identity. This fix has been backported to all supported release lines.
Potential Impact
An authenticated attacker can trick a victim into visiting a specially crafted URL that abuses the UUID-based subdomain spoofing to bypass CORS origin checks. This enables the attacker’s JavaScript to perform credentialed cross-origin fetch requests to the victim’s workspace apps and read sensitive data accessible through those apps. The vulnerability affects confidentiality but does not impact integrity or availability.
Mitigation Recommendations
Official patches are available and have been backported to all supported release lines: versions 2.34.2, 2.33.8, 2.32.7, and 2.29.17. Users should upgrade to these fixed versions to remediate the vulnerability. No workarounds are available. Applying the official fix fully mitigates the issue by validating the subdomain username against the actual workspace owner and enforcing correct CORS origin checks.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-5wg6-jmq2-53pw
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-55438"]
- Ecosystems
- ["Go"]
- Database Specific Severity
- MODERATE
- Cvss Version
- 3.1
Threat ID: 6a4c340227e9c797195f5e51
Added to database: 07/06/2026, 23:02:26 UTC
Last enriched: 07/06/2026, 23:11:13 UTC
Last updated: 07/06/2026, 23:11:13 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.