CVE-2026-55428: Anthropic Python agent IP spoofing

Q: Is CVE-2026-55428 actively exploited?

No confirmed active exploitation of CVE-2026-55428 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2026-55428?

Upgrade immediately to the patched version matching your release line: v2.34.2, v2.33.8, v2.32.7, or v2.29.17 (ESR). If immediate upgrade isn't possible, monitor tailnet coordinator logs for agents advertising `AllowedIPs` prefixes that don't correspond to their own authenticated UUID — this is the concrete IOC called out in the advisory. Restrict who can register or modify workspace agent binaries, since exploitation requires deploying a modified agent, and review workspace creation/agent-registration permissions to limit the pool of users who could stage this attack. After patching, audit recent coordinator logs retroactively for the same anomaly pattern to rule out prior exploitation.

Q: What systems are affected by CVE-2026-55428?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, AI development workspaces, model serving.

Q: What is the CVSS score for CVE-2026-55428?

CVE-2026-55428 has a CVSS v3.1 base score of 8.2 (HIGH). The EPSS exploitation probability is 0.40%.

CISO Take

A vulnerability in Coder's tailnet coordinator lets a malicious workspace agent claim another agent's tailnet IP address because `AllowedIPs` isn't validated against the agent's authenticated identity the way `Addresses` is, letting the attacker intercept web terminal and workspace app traffic and serve spoofed content to the victim. This carries a high CVSS of 8.2 (network-exploitable confidentiality and integrity impact), and blast radius is meaningful given 5,435 downstream dependents and a history of 35 other CVEs in this package, but real-world risk is currently contained: there's no EPSS score, no CISA KEV listing, no public exploit code, and no Nuclei template, and exploitation demands an authenticated user running a custom-modified agent binary rather than a remote unauthenticated attacker. For organizations running Coder as the backbone of AI/ML development workspaces (notebooks, training environments, model serving sandboxes), this matters because a compromised or malicious agent could hijack sessions to other developers' workspaces, potentially exposing model weights, training data, or API credentials in transit. Patch to v2.34.2, v2.33.8, v2.32.7, or v2.29.17 (ESR) depending on your release line now; until then, monitor coordinator logs for agents advertising unexpected `AllowedIPs` prefixes as a detection control.

Sources: NVD GitHub Advisory CISA KEV

What is the risk?

High severity (CVSS 8.2) but currently low observed exploitation likelihood: attack complexity is rated high and requires an authenticated principal with a running workspace who deploys a modified agent binary — not a drive-by or unauthenticated remote exploit. No EPSS percentile, KEV listing, public PoC, or scanner coverage exists yet, so this is a patch-now-not-panic situation rather than an active-exploitation emergency. The confidentiality and integrity impact is significant (network traffic interception and spoofing) with no availability impact, and the scope is changed (S:C), meaning a compromised agent affects resources beyond its own security context — namely, other users' workspace sessions on the same tailnet.

How does the attack unfold?

Initial Access

An authenticated user with a running Coder workspace deploys a modified workspace agent binary that connects to the tailnet coordinator.

Authorization Bypass

The malicious agent advertises `AllowedIPs` containing a victim agent's tailnet address prefix; the coordinator forwards this unvalidated to tunnel peers.

Traffic Interception

Peers install the spoofed route into their WireGuard configuration, causing `ServerTailnet` to route victim-bound traffic to the attacker's agent.

Impact

The attacker intercepts web terminal and workspace app traffic and can serve spoofed content back to the victim, exposing credentials, commands, or data handled in the workspace session.

Initial Access

An authenticated user with a running Coder workspace deploys a modified workspace agent binary that connects to the tailnet coordinator.

Authorization Bypass

The malicious agent advertises `AllowedIPs` containing a victim agent's tailnet address prefix; the coordinator forwards this unvalidated to tunnel peers.

Traffic Interception

Peers install the spoofed route into their WireGuard configuration, causing `ServerTailnet` to route victim-bound traffic to the attacker's agent.

Impact

The attacker intercepts web terminal and workspace app traffic and can serve spoofed content back to the victim, exposing credentials, commands, or data handled in the workspace session.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Anthropic Python	go	>= 2.34.0, < 2.34.2	`2.34.2`
3.8K 5.2K dependents Pushed 4d ago 90% patched ~11d to patch Full package profile →

Do you use Anthropic Python? You're affected.

How severe is it?

CVSS 3.1

8.2 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 33% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC High

PR Low

UI None

S Changed

C High

I High

A None

What should I do?

1 step

Upgrade immediately to the patched version matching your release line: v2.34.2, v2.33.8, v2.32.7, or v2.29.17 (ESR). If immediate upgrade isn't possible, monitor tailnet coordinator logs for agents advertising AllowedIPs prefixes that don't correspond to their own authenticated UUID — this is the concrete IOC called out in the advisory. Restrict who can register or modify workspace agent binaries, since exploitation requires deploying a modified agent, and review workspace creation/agent-registration permissions to limit the pool of users who could stage this attack. After patching, audit recent coordinator logs retroactively for the same anomaly pattern to rule out prior exploitation.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Privacy Violation Agent

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.6.2.6 - AI system operation and monitoring — infrastructure security

NIST AI RMF

GOVERN 4.1 / MANAGE 2.1 - Risk controls for third-party and infrastructure components supporting AI systems

Frequently Asked Questions

What is CVE-2026-55428?

A vulnerability in Coder's tailnet coordinator lets a malicious workspace agent claim another agent's tailnet IP address because `AllowedIPs` isn't validated against the agent's authenticated identity the way `Addresses` is, letting the attacker intercept web terminal and workspace app traffic and serve spoofed content to the victim. This carries a high CVSS of 8.2 (network-exploitable confidentiality and integrity impact), and blast radius is meaningful given 5,435 downstream dependents and a history of 35 other CVEs in this package, but real-world risk is currently contained: there's no EPSS score, no CISA KEV listing, no public exploit code, and no Nuclei template, and exploitation demands an authenticated user running a custom-modified agent binary rather than a remote unauthenticated attacker. For organizations running Coder as the backbone of AI/ML development workspaces (notebooks, training environments, model serving sandboxes), this matters because a compromised or malicious agent could hijack sessions to other developers' workspaces, potentially exposing model weights, training data, or API credentials in transit. Patch to v2.34.2, v2.33.8, v2.32.7, or v2.29.17 (ESR) depending on your release line now; until then, monitor coordinator logs for agents advertising unexpected `AllowedIPs` prefixes as a detection control.

Is CVE-2026-55428 actively exploited?

No confirmed active exploitation of CVE-2026-55428 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-55428?

Upgrade immediately to the patched version matching your release line: v2.34.2, v2.33.8, v2.32.7, or v2.29.17 (ESR). If immediate upgrade isn't possible, monitor tailnet coordinator logs for agents advertising `AllowedIPs` prefixes that don't correspond to their own authenticated UUID — this is the concrete IOC called out in the advisory. Restrict who can register or modify workspace agent binaries, since exploitation requires deploying a modified agent, and review workspace creation/agent-registration permissions to limit the pool of users who could stage this attack. After patching, audit recent coordinator logs retroactively for the same anomaly pattern to rule out prior exploitation.

What systems are affected by CVE-2026-55428?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, AI development workspaces, model serving.

What is the CVSS score for CVE-2026-55428?

CVE-2026-55428 has a CVSS v3.1 base score of 8.2 (HIGH). The EPSS exploitation probability is 0.40%.

What is the AI security impact?

Affected AI Architectures

agent frameworksAI development workspacesmodel serving

Compliance Controls Affected

ISO 42001: A.6.2.6

NIST AI RMF: GOVERN 4.1 / MANAGE 2.1

What are the technical details?

Original Advisory

### Summary The tailnet coordinator validates that an agent's `Addresses` derive from its authenticated UUID but applies no equivalent check to `AllowedIPs`. The coordinator forwards agent-supplied `AllowedIPs` verbatim to tunnel peers which install them into the WireGuard peer configuration. ### Impact A malicious workspace agent can advertise arbitrary `AllowedIPs` prefixes including another agent's tailnet address. Coder's `ServerTailnet` routes to agents by tailnet IP so an agent that claims a victim's prefix can intercept web terminal and workspace app traffic and serve spoofed content. Exploitation requires an authenticated user with a running workspace and a modified agent binary. ### Patches The fix validates each `AllowedIPs` prefix against the authenticating agent's UUID just like `Addresses`. The fix was backported to all supported release lines: | Release line | Patched version | |---|---| | 2.34 | [v2.34.2](https://github.com/coder/coder/releases/tag/v2.34.2) | | 2.33 | [v2.33.8](https://github.com/coder/coder/releases/tag/v2.33.8) | | 2.32 | [v2.32.7](https://github.com/coder/coder/releases/tag/v2.32.7) | | 2.29 (ESR) | [v2.29.17](https://github.com/coder/coder/releases/tag/v2.29.17) | ### Workarounds Operators who cannot upgrade immediately should monitor coordinator logs for agents advertising unexpected `AllowedIPs` prefixes. ### Resources - Fix: #26144 ### Credits Coder would like to thank Anthropic's Security Team (ANT-2026-22451) for independently disclosing this issue!

Exploitation Scenario

An authenticated but low-trust user (e.g., a contractor or compromised developer account) spins up a Coder workspace and replaces the standard agent binary with a modified one. That agent connects to the tailnet coordinator and advertises `AllowedIPs` containing a victim developer's known tailnet address prefix instead of its own. Because the coordinator only validates `Addresses` against the authenticated UUID and forwards `AllowedIPs` verbatim, peers install the spoofed route into their WireGuard configuration. Subsequent traffic destined for the victim's workspace — such as a web terminal session or a forwarded model-serving endpoint — is instead routed to the attacker's agent, which can passively capture credentials and commands or actively serve spoofed content, such as a fake login prompt or altered notebook output, back to the victim.

Weaknesses (CWE)

CWE-285 Improper Authorization Primary CWE-863 Incorrect Authorization Primary CWE-285 Improper Authorization CWE-863 Incorrect Authorization

CWE-285 — Improper Authorization: The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

[Architecture and Design] Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
[Architecture and Design] Ensure that you perform access control checks related to your business logic. These checks may be different than the access control checks that you apply to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor.

Source: MITRE CWE corpus.