V2: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing (CVE-2026-55438)
### Summary Coder's subdomain-based workspace app proxy allowed the same-owner CORS check to be bypassed. When a workspace-name subdomain segment parsed as a UUID, the workspace was resolved by ID without confirming the URL's username matched the real owner, while the CORS middleware trusted the unverified username in the hostname. > **Note:** Practical exploitation requires subdomain app routing (wildcard hostname) enabled and a victim who visits the attacker's crafted app URL while authenticated. ### Impact An authenticated user could craft a subdomain encoding their own workspace UUID and a victim's username. If the victim visited the attacker's URL, the attacker's JavaScript could issue credentialed cross-origin `fetch()` requests to the victim's workspace apps and read the responses, exfiltrating data accessible through those apps. ### Patches The fix validates the subdomain username against the resolved workspace's actual owner and bases the same-owner CORS decision on the authoritative owner identity. The fix was backported to all supported release lines: | Release line | Patched version | |---|---| | 2.34 | [v2.34.2](https://github.com/coder/coder/releases/tag/v2.34.2) | | 2.33 | [v2.33.8](https://github.com/coder/coder/releases/tag/v2.33.8) | | 2.32 | [v2.32.7](https://github.com/coder/coder/releases/tag/v2.32.7) | | 2.29 (ESR) | [v2.29.17](https://github.com/coder/coder/releases/tag/v2.29.17) | ### Workarounds None. ### Resources - Fix: #26086, #26085 ### Credits Coder would like to thank Anthropic's Security Team (ANT-2026-22434) for independently disclosing this issue!
AI Analysis
Technical Summary
The vulnerability in Coder's subdomain-based workspace app proxy allowed bypassing the same-owner CORS check by exploiting how workspace-name subdomains parsed as UUIDs were resolved by ID without verifying that the URL username matched the real owner. The CORS middleware trusted the unverified username in the hostname, enabling an authenticated attacker to craft URLs that could cause a victim's browser to issue credentialed cross-origin fetch requests to the victim's workspace apps and expose sensitive data. The fix enforces validation of the subdomain username against the resolved workspace owner and bases CORS decisions on the verified owner identity. This fix has been backported to all supported release lines.
Potential Impact
An authenticated attacker can trick a victim into visiting a specially crafted URL that abuses the UUID-based subdomain spoofing to bypass CORS origin checks. This enables the attacker’s JavaScript to perform credentialed cross-origin fetch requests to the victim’s workspace apps and read sensitive data accessible through those apps. The vulnerability affects confidentiality but does not impact integrity or availability.
Mitigation Recommendations
Official patches are available and have been backported to all supported release lines: versions 2.34.2, 2.33.8, 2.32.7, and 2.29.17. Users should upgrade to these fixed versions to remediate the vulnerability. No workarounds are available. Applying the official fix fully mitigates the issue by validating the subdomain username against the actual workspace owner and enforcing correct CORS origin checks.
V2: Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing (CVE-2026-55438)
Description
### Summary Coder's subdomain-based workspace app proxy allowed the same-owner CORS check to be bypassed. When a workspace-name subdomain segment parsed as a UUID, the workspace was resolved by ID without confirming the URL's username matched the real owner, while the CORS middleware trusted the unverified username in the hostname. > **Note:** Practical exploitation requires subdomain app routing (wildcard hostname) enabled and a victim who visits the attacker's crafted app URL while authenticated. ### Impact An authenticated user could craft a subdomain encoding their own workspace UUID and a victim's username. If the victim visited the attacker's URL, the attacker's JavaScript could issue credentialed cross-origin `fetch()` requests to the victim's workspace apps and read the responses, exfiltrating data accessible through those apps. ### Patches The fix validates the subdomain username against the resolved workspace's actual owner and bases the same-owner CORS decision on the authoritative owner identity. The fix was backported to all supported release lines: | Release line | Patched version | |---|---| | 2.34 | [v2.34.2](https://github.com/coder/coder/releases/tag/v2.34.2) | | 2.33 | [v2.33.8](https://github.com/coder/coder/releases/tag/v2.33.8) | | 2.32 | [v2.32.7](https://github.com/coder/coder/releases/tag/v2.32.7) | | 2.29 (ESR) | [v2.29.17](https://github.com/coder/coder/releases/tag/v2.29.17) | ### Workarounds None. ### Resources - Fix: #26086, #26085 ### Credits Coder would like to thank Anthropic's Security Team (ANT-2026-22434) for independently disclosing this issue!
CVSS v3.1
Score 5.8medium
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in Coder's subdomain-based workspace app proxy allowed bypassing the same-owner CORS check by exploiting how workspace-name subdomains parsed as UUIDs were resolved by ID without verifying that the URL username matched the real owner. The CORS middleware trusted the unverified username in the hostname, enabling an authenticated attacker to craft URLs that could cause a victim's browser to issue credentialed cross-origin fetch requests to the victim's workspace apps and expose sensitive data. The fix enforces validation of the subdomain username against the resolved workspace owner and bases CORS decisions on the verified owner identity. This fix has been backported to all supported release lines.
Potential Impact
An authenticated attacker can trick a victim into visiting a specially crafted URL that abuses the UUID-based subdomain spoofing to bypass CORS origin checks. This enables the attacker’s JavaScript to perform credentialed cross-origin fetch requests to the victim’s workspace apps and read sensitive data accessible through those apps. The vulnerability affects confidentiality but does not impact integrity or availability.
Mitigation Recommendations
Official patches are available and have been backported to all supported release lines: versions 2.34.2, 2.33.8, 2.32.7, and 2.29.17. Users should upgrade to these fixed versions to remediate the vulnerability. No workarounds are available. Applying the official fix fully mitigates the issue by validating the subdomain username against the actual workspace owner and enforcing correct CORS origin checks.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-5wg6-jmq2-53pw
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-55438"]
- Ecosystems
- ["Go"]
- Database Specific Severity
- MODERATE
- Cvss Version
- 3.1
Threat ID: 6a4c340227e9c797195f5e51
Added to database: 07/06/2026, 23:02:26 UTC
Last enriched: 07/06/2026, 23:11:13 UTC
Last updated: 07/31/2026, 19:22:59 UTC
Views: 57
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.