CVE-2026-55429: Anthropic Python cross-workspace

Q: Is CVE-2026-55429 actively exploited?

No confirmed active exploitation of CVE-2026-55429 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2026-55429?

Patch immediately to the version matching your release line: v2.34.2 (2.34.x), v2.33.8 (2.33.x), v2.32.7 (2.32.x), or v2.29.17 (2.29 ESR) — there is no workaround. Until patched, minimize the population of users granted template-author or external-provisioner-operator roles and treat those roles as high-privilege/insider-risk. Audit current role assignments for template authorship and external provisioner registration. Post-patch, monitor for anomalous `workspace_apps.agent_id` changes or unexpected provisioner `CompleteJob` submissions referencing app UUIDs outside the submitting workspace, and review provisioner/build logs for users probing app UUIDs via the public API.

Q: What systems are affected by CVE-2026-55429?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, developer workspace provisioning, AI coding agent sandboxes.

Q: What is the CVSS score for CVE-2026-55429?

CVE-2026-55429 has a CVSS v3.1 base score of 8.7 (HIGH). The EPSS exploitation probability is 0.29%.

CISO Take

A privilege-check gap in Coder's workspace provisioning flow lets a user with template authorship or external provisioner access rebind another workspace's app entry to an agent they control, because the CompleteJob handler trusts the app ID supplied in the provisioner payload without checking it belongs to the workspace being built. This matters because Coder underpins self-hosted dev and AI-agent workspace platforms with over 5,400 downstream dependents, and a successful hijack silently reroutes the victim's IDE and terminal sessions to attacker-controlled infrastructure — a session-hijacking primitive with high confidentiality and integrity impact (CVSS 8.7). There is no CISA KEV listing, no published EPSS score, and no public exploit or Nuclei template, so this looks like a disclosed-not-exploited bug rather than an active campaign, but the prerequisite (template author or external provisioner role) is a realistic insider or partner-access scenario in many enterprise Coder deployments. There is no workaround — patch immediately to v2.34.2, v2.33.8, v2.32.7, or the 2.29 ESR release v2.29.17 depending on your release line, and audit who currently holds template-author or external-provisioner roles in the interim.

Sources: NVD GitHub Advisory CISA KEV ATLAS

What is the risk?

High severity (CVSS 8.7) but gated behind a non-trivial prerequisite: the attacker must already hold template authorship or external provisioner operator privileges, which are not default end-user roles. This shifts the realistic threat model toward malicious or compromised insiders, contractors, or partner-integrated provisioner operators rather than opportunistic internet-wide exploitation. No EPSS score, no CISA KEV entry, and no public PoC/Nuclei coverage all point to low current exploitation probability, but the confidentiality and integrity impact once triggered is severe — full redirection of a victim's IDE/terminal traffic to attacker infrastructure with scope change (S:C). Organizations that expose template authoring or external provisioner registration broadly, or that use Coder to provision isolated environments for AI coding agents/assistants, carry elevated exposure.

How does the attack unfold?

Initial Access

Attacker obtains or already holds a template-author or external-provisioner-operator role within the Coder deployment.

AML.T0012

Target Discovery

Attacker discovers the victim's workspace app UUID via the public API.

AML.T0006

Exploitation

Attacker submits a crafted CompleteJob payload during their own workspace build, pairing the victim's app UUID with an attacker-controlled agent ID; the authorization layer under AsProvisionerd does not reject the cross-workspace rebind.

Impact

The victim's app traffic (IDE, terminal, and other proxied sessions) is transparently redirected to the attacker's workspace, enabling session hijack and data interception.

Initial Access

Attacker obtains or already holds a template-author or external-provisioner-operator role within the Coder deployment.

AML.T0012

Target Discovery

Attacker discovers the victim's workspace app UUID via the public API.

AML.T0006

Exploitation

Attacker submits a crafted CompleteJob payload during their own workspace build, pairing the victim's app UUID with an attacker-controlled agent ID; the authorization layer under AsProvisionerd does not reject the cross-workspace rebind.

Impact

The victim's app traffic (IDE, terminal, and other proxied sessions) is transparently redirected to the attacker's workspace, enabling session hijack and data interception.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Anthropic Python	go	>= 2.34.0, < 2.34.2	`2.34.2`
3.8K 5.2K dependents Pushed yesterday 90% patched ~11d to patch Full package profile →

Do you use Anthropic Python? You're affected.

How severe is it?

CVSS 3.1

8.7 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 21% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC Low

PR High

UI None

S Changed

C High

I High

A None

What should I do?

1 step

Patch immediately to the version matching your release line: v2.34.2 (2.34.x), v2.33.8 (2.33.x), v2.32.7 (2.32.x), or v2.29.17 (2.29 ESR) — there is no workaround. Until patched, minimize the population of users granted template-author or external-provisioner-operator roles and treat those roles as high-privilege/insider-risk. Audit current role assignments for template authorship and external provisioner registration. Post-patch, monitor for anomalous workspace_apps.agent_id changes or unexpected provisioner CompleteJob submissions referencing app UUIDs outside the submitting workspace, and review provisioner/build logs for users probing app UUIDs via the public API.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Privacy Violation Agent API AML.T0012 - Valid Accounts

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

NIST AI RMF

MANAGE 4.1 - Post-deployment monitoring of AI system risks

Frequently Asked Questions

What is CVE-2026-55429?

A privilege-check gap in Coder's workspace provisioning flow lets a user with template authorship or external provisioner access rebind another workspace's app entry to an agent they control, because the CompleteJob handler trusts the app ID supplied in the provisioner payload without checking it belongs to the workspace being built. This matters because Coder underpins self-hosted dev and AI-agent workspace platforms with over 5,400 downstream dependents, and a successful hijack silently reroutes the victim's IDE and terminal sessions to attacker-controlled infrastructure — a session-hijacking primitive with high confidentiality and integrity impact (CVSS 8.7). There is no CISA KEV listing, no published EPSS score, and no public exploit or Nuclei template, so this looks like a disclosed-not-exploited bug rather than an active campaign, but the prerequisite (template author or external provisioner role) is a realistic insider or partner-access scenario in many enterprise Coder deployments. There is no workaround — patch immediately to v2.34.2, v2.33.8, v2.32.7, or the 2.29 ESR release v2.29.17 depending on your release line, and audit who currently holds template-author or external-provisioner roles in the interim.

Is CVE-2026-55429 actively exploited?

No confirmed active exploitation of CVE-2026-55429 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-55429?

Patch immediately to the version matching your release line: v2.34.2 (2.34.x), v2.33.8 (2.33.x), v2.32.7 (2.32.x), or v2.29.17 (2.29 ESR) — there is no workaround. Until patched, minimize the population of users granted template-author or external-provisioner-operator roles and treat those roles as high-privilege/insider-risk. Audit current role assignments for template authorship and external provisioner registration. Post-patch, monitor for anomalous `workspace_apps.agent_id` changes or unexpected provisioner `CompleteJob` submissions referencing app UUIDs outside the submitting workspace, and review provisioner/build logs for users probing app UUIDs via the public API.

What systems are affected by CVE-2026-55429?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, developer workspace provisioning, AI coding agent sandboxes.

What is the CVSS score for CVE-2026-55429?

CVE-2026-55429 has a CVSS v3.1 base score of 8.7 (HIGH). The EPSS exploitation probability is 0.29%.

What is the AI security impact?

Affected AI Architectures

agent frameworksdeveloper workspace provisioningAI coding agent sandboxes

MITRE ATLAS Techniques

AML.T0012 Valid Accounts

Compliance Controls Affected

EU AI Act: Article 15

NIST AI RMF: MANAGE 4.1

What are the technical details?

Original Advisory

### Summary `UpsertWorkspaceApp` overwrites an existing app's `agent_id` on a primary-key conflict and `insertAgentApp` accepts the app ID from the provisioner's `CompleteJob` payload without verifying it belongs to the workspace being built. `CompleteJob` runs under `dbauthz.AsProvisionerd` so the authorization layer does not block the cross-workspace upsert. > **Note:** Exploitation requires elevated access as a template author or external provisioner operator. ### Impact A user with template authorship or external provisioner access can submit a `CompleteJob` payload with a known victim app UUID and an attacker-controlled agent ID. On completion of the attacker's build the victim's app row is rebound to the attacker's agent so later app traffic such as IDE and terminal sessions is proxied to the attacker's workspace. App UUIDs are discoverable through the public API. ### Patches The fix verifies that any existing `workspace_apps` row matching the supplied ID belongs to the workspace being built and rejects cross-workspace agent reassignment. The fix was backported to all supported release lines: | Release line | Patched version | |---|---| | 2.34 | [v2.34.2](https://github.com/coder/coder/releases/tag/v2.34.2) | | 2.33 | [v2.33.8](https://github.com/coder/coder/releases/tag/v2.33.8) | | 2.32 | [v2.32.7](https://github.com/coder/coder/releases/tag/v2.32.7) | | 2.29 (ESR) | [v2.29.17](https://github.com/coder/coder/releases/tag/v2.29.17) | ### Workarounds None. Upgrading is required. ### Resources - Fix: #26103 ### Credits Coder would like to thank Anthropic's Security Team (ANT-2026-22441) for independently disclosing this issue!

Exploitation Scenario

An attacker who holds a template-author role (or operates an external provisioner) enumerates the public API to discover the UUID of a high-value victim's workspace app — for example, a senior engineer's or an AI coding-agent supervisor's IDE endpoint. The attacker starts their own workspace build and crafts a `CompleteJob` payload that references the victim's known app UUID paired with their own attacker-controlled agent ID. Because `CompleteJob` executes under `dbauthz.AsProvisionerd`, the authorization layer does not verify that the app belongs to the workspace being built, so `UpsertWorkspaceApp`/`insertAgentApp` silently rebinds the victim's app row to the attacker's agent. From that point, when the victim opens their IDE or terminal session, traffic is transparently proxied through the attacker's workspace, letting the attacker observe code, credentials, or AI-agent session data in transit — all without triggering any authorization failure.

Weaknesses (CWE)

CWE-639 Authorization Bypass Through User-Controlled Key Primary CWE-639 Authorization Bypass Through User-Controlled Key

CWE-639 — Authorization Bypass Through User-Controlled Key: The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

[Architecture and Design] For each and every data access, ensure that the user has sufficient privilege to access the record that is being requested.
[Architecture and Design, Implementation] Make sure that the key that is used in the lookup of a specific user's record is not controllable externally by the user or that any tampering can be detected.

Source: MITRE CWE corpus.