AI Threat Alert
Coder's AI Bridge Proxy shipped with a default HTTP transport that set InsecureSkipVerify to true, so it accepted any TLS certificate when calling out to the Coder access URL unless an upstream proxy was explicitly configured. For a CISO, the practical risk hinges on network position: this is not remotely exploitable over the open internet on its own — an attacker needs an on-path foothold via ARP spoofing, DNS poisoning, or control of the HTTP_PROXY/HTTPS_PROXY environment variables between the proxy and the Coder server, which is reflected in the CVSS AC:H rating (7.4 overall) and the absence of any EPSS score, CISA KEV listing, or public exploit/Nuclei template. The blast radius per successful interception is still severe: injected Coder session tokens, user-supplied BYOK provider API keys, and full prompt/completion bodies traverse the connection in the clear to any attacker who pulls off the MITM. Deployments where the proxy and Coder server communicate over loopback are effectively unaffected, so real exposure concentrates on split-network or cloud-segmented Coder installs. Action: upgrade to v2.34.2, v2.33.8, or v2.32.7 wherever the proxy and Coder server are not co-located, and in the interim enforce a trusted certificate on the Coder access URL plus a secured path (loopback or mTLS) between the two.
What is the risk?
High-severity confidentiality/integrity issue (CVSS 7.4, C:H/I:H/A:N) gated behind a high attack-complexity requirement (AC:H) — the attacker must already hold or obtain an on-path network position between the AI Bridge Proxy and the Coder server. There is no CISA KEV listing, no EPSS score, no public PoC, and no Nuclei template, indicating no evidence of active or automated exploitation in the wild; this is a disclosed misconfiguration (credited to Anthropic's Security Team) rather than an observed attack. Risk is elevated in shared, multi-tenant, or cloud-segmented Coder deployments where the proxy and Coder server do not share a trusted loopback boundary, and in any environment where proxy environment variables (HTTP_PROXY/HTTPS_PROXY) are attacker-influenceable. Overall: high impact if triggered, low likelihood without an existing network foothold — prioritize based on deployment topology rather than treating as an emergency KEV-style patch.
How does the attack unfold?
What systems are affected?
| Package | Ecosystem | Vulnerable Range | Patched |
|---|---|---|---|
| Anthropic Python | go | >= 2.34.0, < 2.34.2 | 2.34.2 |
Do you use Anthropic Python? You're affected.
How severe is it?
What is the attack surface?
What should I do?
1 step-
Upgrade immediately to the patched release for your line: v2.34.2, v2.33.8, or v2.32.7 (all apply the secure transport — TLS 1.2+ with system root CAs — unconditionally). If immediate upgrade isn't possible, ensure the Coder access URL presents a certificate from a trusted CA and secure the network path between the AI Bridge Proxy and the Coder server (co-locate over loopback or enforce mTLS). Audit and lock down HTTP_PROXY/HTTPS_PROXY environment variables in the AI Bridge Proxy's runtime to prevent traffic redirection. Detection: review network logs for unexpected TLS certificate changes or unusual outbound connections from the aibridgeproxyd host, and rotate any BYOK provider API keys and Coder session tokens that may have transited an unpatched instance in a non-loopback deployment.
What does CISA's SSVC say?
Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.
How is it classified?
Which compliance frameworks are affected?
This CVE is relevant to:
Frequently Asked Questions
What is CVE-2026-55436?
Coder's AI Bridge Proxy shipped with a default HTTP transport that set InsecureSkipVerify to true, so it accepted any TLS certificate when calling out to the Coder access URL unless an upstream proxy was explicitly configured. For a CISO, the practical risk hinges on network position: this is not remotely exploitable over the open internet on its own — an attacker needs an on-path foothold via ARP spoofing, DNS poisoning, or control of the HTTP_PROXY/HTTPS_PROXY environment variables between the proxy and the Coder server, which is reflected in the CVSS AC:H rating (7.4 overall) and the absence of any EPSS score, CISA KEV listing, or public exploit/Nuclei template. The blast radius per successful interception is still severe: injected Coder session tokens, user-supplied BYOK provider API keys, and full prompt/completion bodies traverse the connection in the clear to any attacker who pulls off the MITM. Deployments where the proxy and Coder server communicate over loopback are effectively unaffected, so real exposure concentrates on split-network or cloud-segmented Coder installs. Action: upgrade to v2.34.2, v2.33.8, or v2.32.7 wherever the proxy and Coder server are not co-located, and in the interim enforce a trusted certificate on the Coder access URL plus a secured path (loopback or mTLS) between the two.
Is CVE-2026-55436 actively exploited?
No confirmed active exploitation of CVE-2026-55436 has been reported, but organizations should still patch proactively.
How to fix CVE-2026-55436?
Upgrade immediately to the patched release for your line: v2.34.2, v2.33.8, or v2.32.7 (all apply the secure transport — TLS 1.2+ with system root CAs — unconditionally). If immediate upgrade isn't possible, ensure the Coder access URL presents a certificate from a trusted CA and secure the network path between the AI Bridge Proxy and the Coder server (co-locate over loopback or enforce mTLS). Audit and lock down HTTP_PROXY/HTTPS_PROXY environment variables in the AI Bridge Proxy's runtime to prevent traffic redirection. Detection: review network logs for unexpected TLS certificate changes or unusual outbound connections from the aibridgeproxyd host, and rotate any BYOK provider API keys and Coder session tokens that may have transited an unpatched instance in a non-loopback deployment.
What systems are affected by CVE-2026-55436?
This vulnerability affects the following AI/ML architecture patterns: agent frameworks, API gateways, cloud development environments.
What is the CVSS score for CVE-2026-55436?
CVE-2026-55436 has a CVSS v3.1 base score of 7.4 (HIGH). The EPSS exploitation probability is 0.26%.
What is the AI security impact?
Affected AI Architectures
MITRE ATLAS Techniques
AML.T0025 Exfiltration via Cyber Means AML.T0091.000 Application Access Token Compliance Controls Affected
What are the technical details?
Original Advisory
### Summary The AI Bridge Proxy (`aibridgeproxyd`) created a goproxy server whose default transport set `InsecureSkipVerify: true` and only assigned a secure transport when an upstream proxy was configured. In the default configuration (no upstream proxy), outbound HTTPS to the Coder access URL accepted any TLS certificate. > **Note:** Practical exploitation requires an on-path (man-in-the-middle) position between the AI Bridge Proxy and the Coder server. Deployments where they are co-located over loopback are effectively unaffected. ### Impact An attacker positioned between the proxy and the Coder server, via ARP spoofing, DNS poisoning or control of proxy environment variables, could intercept injected Coder session tokens, user-supplied provider API keys (BYOK) and full request and response bodies including prompts and completions. The default transport also honored `HTTP_PROXY` and `HTTPS_PROXY`, allowing environment-based traffic redirection. ### Patches The fix applies the secure transport (TLS 1.2 or higher using system root CAs) unconditionally. The AI Bridge Proxy was introduced in v2.30.0. Earlier release lines including the v2.29 ESR line are not affected. The fix is available in the following releases: | Release line | Patched version | |---|---| | 2.34 | [v2.34.2](https://github.com/coder/coder/releases/tag/v2.34.2) | | 2.33 | [v2.33.8](https://github.com/coder/coder/releases/tag/v2.33.8) | | 2.32 | [v2.32.7](https://github.com/coder/coder/releases/tag/v2.32.7) | ### Workarounds Ensure the Coder access URL uses a trusted certificate and secure the network path between the AI Bridge Proxy and the Coder server (for example, loopback or mTLS). ### Resources - Fix: #26131 ### Credits Coder would like to thank Anthropic's Security Team (ANT-2026-22455) for independently disclosing this issue!
Exploitation Scenario
An attacker gains an on-path position between the AI Bridge Proxy and the Coder server — for example, via ARP spoofing on a shared segment, DNS poisoning of the Coder access URL, or by tampering with HTTP_PROXY/HTTPS_PROXY environment variables in a CI/CD or containerized deployment. The attacker stands up a TLS-terminating interception proxy presenting a self-signed or forged certificate; because aibridgeproxyd's default transport has InsecureSkipVerify set, it accepts the certificate without complaint. All subsequent traffic — injected Coder session tokens, developer-supplied BYOK provider API keys, and complete prompt/completion bodies from AI coding sessions — flows through the attacker's proxy in cleartext from Coder's perspective. The attacker can then replay the stolen session token to impersonate the developer within Coder, reuse the harvested API keys against the provider directly, and mine the captured prompts/completions for proprietary code, secrets, or IP.
Weaknesses (CWE)
CWE-295 — Improper Certificate Validation: The product does not validate, or incorrectly validates, a certificate.
- [Architecture and Design, Implementation] Certificates should be carefully managed and checked to assure that data are encrypted with the intended owner's public key.
- [Implementation] If certificate pinning is being used, ensure that all relevant properties of the certificate are fully validated before the certificate is pinned, including the hostname.
Source: MITRE CWE corpus.
CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N References
Timeline
Related Vulnerabilities
CVE-2026-27775 8.8 Gitea: cached permission check allows repo takeover
Same package: anthropic CVE-2026-54449 8.8 LangBot: RCE via arbitrary STDIO MCP command
Same package: anthropic CVE-2026-7574 8.7 Claude Desktop: VM integrity bypass enables RCE
Same package: anthropic CVE-2026-55429 8.7 Coder: cross-workspace agent hijack via app ID reuse
Same package: anthropic CVE-2026-67428 8.5 Flyto2 Core: SSRF via unvalidated URLs in agent tools
Same package: anthropic