AI Threat Alert
A missing authorization check in Coder's CreateSubAgent RPC let a workspace owner set an app's sharing level to PUBLIC even when the administrator's Enterprise port-sharing policy capped it at owner-only, exposing the app to unauthenticated users via the wildcard app domain. The blast radius is narrow but real for CISOs running Coder as the substrate for AI coding agents: only deployments using Enterprise port-sharing policy plus wildcard app hostnames are affected, and exploitation requires an authenticated workspace owner with a valid agent token, so this is an insider-misuse/policy-bypass issue rather than a remote unauthenticated attack path. There's no CISA KEV listing, no EPSS score, and no public exploit or scanner template, so opportunistic mass exploitation is unlikely — but the vulnerability class (CWE-862, missing authorization) is exactly the kind of gap that turns a well-configured guardrail into a false sense of security. Patch to v2.34.2 (or the matching backport for your release line: 2.33.8, 2.32.7, 2.29.17 ESR); if you can't patch immediately, disable `CODER_WILDCARD_ACCESS_URL` to block subdomain-based app routing and audit existing workspace apps for sharing levels that exceed template policy.
What is the risk?
Medium severity (CVSS 5.4, AV:N/AC:L/PR:L/UI:N/C:L/I:L/A:N) reflects a confidentiality/integrity-limited, low-privilege, no-user-interaction exploit path. Exploitability is bounded by three preconditions: Enterprise port-sharing policy enabled, wildcard app hostnames enabled, and an authenticated workspace owner holding an agent token — this is not remotely exploitable by an anonymous internet attacker against a default deployment. No EPSS score, no CISA KEV entry, no known public exploit or Nuclei template exists, indicating no evidence of active or automated exploitation. The realistic risk is policy circumvention by a semi-trusted insider (a developer or an AI agent acting with a workspace owner's token) rather than external compromise, but the downstream package footprint (5,435 dependents) means this affects a broad base of Coder deployments that may not realize their port-sharing policy has a gap.
How does the attack unfold?
What systems are affected?
| Package | Ecosystem | Vulnerable Range | Patched |
|---|---|---|---|
| Anthropic Python | go | >= 2.34.0, < 2.34.2 | 2.34.2 |
Do you use Anthropic Python? You're affected.
How severe is it?
What is the attack surface?
What should I do?
1 step-
Upgrade to the patched version matching your release line: v2.34.2 (2.34.x), v2.33.8 (2.33.x), v2.32.7 (2.32.x), or v2.29.17 (2.29 ESR) — the fix clamps sub-agent app sharing level to the template's MaxPortSharingLevel server-side. As an immediate workaround before patching, disable
CODER_WILDCARD_ACCESS_URLto prevent subdomain-based app routing, which blocks the exposure path even if the sharing level is set incorrectly. For detection, audit workspace apps registered via sub-agents for a sharing level of PUBLIC that exceeds the template's configured MaxPortSharingLevel, and review agent-token activity logs for CreateSubAgent calls requesting elevated sharing levels.
What does CISA's SSVC say?
Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.
How is it classified?
Which compliance frameworks are affected?
This CVE is relevant to:
Frequently Asked Questions
What is CVE-2026-55432?
A missing authorization check in Coder's CreateSubAgent RPC let a workspace owner set an app's sharing level to PUBLIC even when the administrator's Enterprise port-sharing policy capped it at owner-only, exposing the app to unauthenticated users via the wildcard app domain. The blast radius is narrow but real for CISOs running Coder as the substrate for AI coding agents: only deployments using Enterprise port-sharing policy plus wildcard app hostnames are affected, and exploitation requires an authenticated workspace owner with a valid agent token, so this is an insider-misuse/policy-bypass issue rather than a remote unauthenticated attack path. There's no CISA KEV listing, no EPSS score, and no public exploit or scanner template, so opportunistic mass exploitation is unlikely — but the vulnerability class (CWE-862, missing authorization) is exactly the kind of gap that turns a well-configured guardrail into a false sense of security. Patch to v2.34.2 (or the matching backport for your release line: 2.33.8, 2.32.7, 2.29.17 ESR); if you can't patch immediately, disable `CODER_WILDCARD_ACCESS_URL` to block subdomain-based app routing and audit existing workspace apps for sharing levels that exceed template policy.
Is CVE-2026-55432 actively exploited?
No confirmed active exploitation of CVE-2026-55432 has been reported, but organizations should still patch proactively.
How to fix CVE-2026-55432?
Upgrade to the patched version matching your release line: v2.34.2 (2.34.x), v2.33.8 (2.33.x), v2.32.7 (2.32.x), or v2.29.17 (2.29 ESR) — the fix clamps sub-agent app sharing level to the template's MaxPortSharingLevel server-side. As an immediate workaround before patching, disable `CODER_WILDCARD_ACCESS_URL` to prevent subdomain-based app routing, which blocks the exposure path even if the sharing level is set incorrectly. For detection, audit workspace apps registered via sub-agents for a sharing level of PUBLIC that exceeds the template's configured MaxPortSharingLevel, and review agent-token activity logs for CreateSubAgent calls requesting elevated sharing levels.
What systems are affected by CVE-2026-55432?
This vulnerability affects the following AI/ML architecture patterns: agent frameworks.
What is the CVSS score for CVE-2026-55432?
CVE-2026-55432 has a CVSS v3.1 base score of 5.4 (MEDIUM). The EPSS exploitation probability is 0.32%.
What is the AI security impact?
Affected AI Architectures
MITRE ATLAS Techniques
AML.T0081 Modify AI Agent Configuration Compliance Controls Affected
What are the technical details?
Original Advisory
### Summary The `CreateSubAgent` RPC did not validate a requested app sharing level against the template's `MaxPortSharingLevel` before persisting workspace apps, letting a workspace owner exceed the administrator's configured maximum. > **Note:** Exploitation requires the ability to register sub-agent apps in a workspace the attacker controls. ### Impact A workspace owner with an agent token could register a sub-agent app as `PUBLIC` even when the template's `MaxPortSharingLevel` was `owner`, exposing the app to unauthenticated users via the wildcard app domain. This affected only deployments using Enterprise port-sharing policy and wildcard app hostnames and required an authenticated workspace owner with an agent token. ### Patches The fix clamps the sub-agent app sharing level to the template's `MaxPortSharingLevel`. The fix was backported to all supported release lines: | Release line | Patched version | |---|---| | 2.34 | [v2.34.2](https://github.com/coder/coder/releases/tag/v2.34.2) | | 2.33 | [v2.33.8](https://github.com/coder/coder/releases/tag/v2.33.8) | | 2.32 | [v2.32.7](https://github.com/coder/coder/releases/tag/v2.32.7) | | 2.29 (ESR) | [v2.29.17](https://github.com/coder/coder/releases/tag/v2.29.17) | ### Workarounds Disable wildcard app hostnames (`CODER_WILDCARD_ACCESS_URL`) to block subdomain-based app routing. ### Resources - Fix: #26061 ### Credits Coder would like to thank Anthropic's Security Team (ANT-2026-22452) for independently disclosing this issue!
Exploitation Scenario
An organization runs Coder with Enterprise port-sharing policy set to 'owner' and wildcard app hostnames enabled for convenient subdomain routing to workspace apps. A developer (or an AI coding agent operating under that developer's issued agent token within their workspace) calls the CreateSubAgent RPC directly and requests a PUBLIC sharing level for a new sub-agent app — for example, a local debug server or internal dashboard the agent spun up. Because the RPC never validated the requested level against the template's MaxPortSharingLevel before persisting it, the app is registered as publicly shared. Any unauthenticated user who discovers or guesses the wildcard app URL (e.g. `app--<port>--<agent>.workspaces.example.com`) can now reach that internal tool directly, bypassing the org's intended access boundary — potentially exposing source code, debug output, or credentials cached in the exposed service.
Weaknesses (CWE)
CWE-862 — Missing Authorization: The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
- [Architecture and Design] Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
- [Architecture and Design] Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
Source: MITRE CWE corpus.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N References
Timeline
Related Vulnerabilities
CVE-2026-27775 8.8 Gitea: cached permission check allows repo takeover
Same package: anthropic CVE-2026-54449 8.8 LangBot: RCE via arbitrary STDIO MCP command
Same package: anthropic CVE-2026-7574 8.7 Claude Desktop: VM integrity bypass enables RCE
Same package: anthropic CVE-2026-55429 8.7 Coder: cross-workspace agent hijack via app ID reuse
Same package: anthropic CVE-2026-67428 8.5 Flyto2 Core: SSRF via unvalidated URLs in agent tools
Same package: anthropic