CVE-2026-55433: Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-07-08 · updated 2026-07-08
Weakness: CWE-862

Description

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, the devcontainer recreate endpoint relied on route middleware that checked only `ActionRead` on the workspace and, unlike the sibling delete endpoint, performed no `ActionUpdate` check before triggering the destructive rebuild. Exploitation requires an existing low-privilege role with access to the target workspace. The fix in versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2 adds an explicit `ActionUpdate` authorization check before the agent is dialed like the delete endpoint. No known workarounds are available.

Affected products

coder: before 2.29.17; from 2.30.0 before 2.32.7; from 2.33.0 before 2.33.8; from 2.34.0 before 2.34.2 — fixed in 2.29.17, 2.32.7, 2.33.8, 2.34.2

How to fix

Upgrade to a fixed version: coder 2.29.17, 2.32.7, 2.33.8, 2.34.2. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-55433 or the next vulnerability affects your stack