The vulnerability exists in the UpsertWorkspaceApp function, which overwrites an existing app's agent_id on primary-key conflict without verifying workspace ownership. The insertAgentApp function accepts an app ID from the CompleteJob payload without confirming it belongs to the workspace being built. Since CompleteJob runs with elevated authorization (dbauthz.AsProvisionerd), cross-workspace upsert is not blocked. An attacker with template author or external provisioner privileges can submit a CompleteJob payload containing a victim app UUID and attacker-controlled agent ID, causing the victim app's agent to be rebound to the attacker. This allows interception of app traffic such as IDE and terminal sessions. The fix enforces verification that the workspace_apps row matches the workspace being built, rejecting cross-workspace agent reassignment. The fix is backported to all supported release lines including 2.34.2, 2.33.8, 2.32.7, and 2.29.17.

An attacker with elevated privileges (template author or external provisioner operator) can rebind a victim app's agent to their own agent by exploiting the upsert process, enabling interception and proxying of the victim's app traffic, including IDE and terminal sessions. This compromises confidentiality and integrity of the victim's workspace app communications. The vulnerability requires elevated privileges and knowledge of victim app UUIDs, which are discoverable via the public API.

A fix is available and has been backported to all supported release lines: versions 2.34.2, 2.33.8, 2.32.7, and 2.29.17. Upgrading to these versions or later is required to mitigate this vulnerability. No workarounds exist. Users should apply the official patches promptly.