5.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-55430

CVE-2026-55430: Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, the workspace app proxy resolves the target app from httpapi.RequestHost() which prefers the X-Forwarded-Host header over the real Host header. No middleware strips X-Forwarded-Host before routing and the header is not browser-forbidden so client-side JavaScript can set it on fetch() calls. Practical exploitation requires subdomain app routing (wildcard hostname) enabled, a victim who visits the attacker's shared app and a deployment whose upstream proxy does not strip X-Forwarded-Host. The fix in versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2 trusts X-Forwarded-Host only from configured trusted proxies and otherwise resolves the routing host from the verified request host. As a workaround, place an upstream reverse proxy that strips or overwrites X-Forwarded-Host on untrusted requests.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-55430

CVE-2026-55430:

5.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/coder/coder/v2	go	>= 2.34.0, < 2.34.2	2.34.2
github.com/coder/coder/v2	go	>= 2.33.0, < 2.33.8	2.33.8
github.com/coder/coder/v2	go	>= 2.30.0, < 2.32.7	2.32.7
github.com/coder/coder/v2	go	< 2.29.17	2.29.17

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability existed because the application blindly trusted the X-Forwarded-Host HTTP header to determine the routing for workspace apps. The core of the issue was in the github.com/coder/coder/v2/coderd/httpapi.RequestHost function, which prioritized this header over the actual Host header without any validation of the request's origin.

The function github.com/coder/coder/v2/coderd/workspaceapps.(*Server).HandleSubdomain utilized RequestHost to resolve the target application. This allowed an attacker, who could control a shared workspace app, to serve JavaScript that sends same-site requests with a forged X-Forwarded-Host header pointing to a victim's private app. The server would then incorrectly route the request based on the attacker-controlled header but authorize it using the victim's session cookie, leading to unauthorized data access.

The patch addresses this by removing the RequestHost function entirely and introducing a new function, httpmw.EffectiveHost. This new function only trusts the X-Forwarded-Host header if the request originates from a configured trusted proxy. The HandleSubdomain function was updated to use this new, secure method for host resolution, thus mitigating the vulnerability.

Vulnerable functions

github.com/coder/coder/v2/coderd/httpapi.RequestHost

coderd/httpapi/request.go

This function was the root cause of the vulnerability. It unconditionally returned the value of the `X-Forwarded-Host` header if it was present in the request, without verifying if the request came from a trusted source. This allowed an attacker to control the host resolution and access internal applications. The function was entirely removed in the patch.

github.com/coder/coder/v2/coderd/workspaceapps.(*Server).HandleSubdomain

coderd/workspaceapps/proxy.go

This function was vulnerable because it used the insecure `httpapi.RequestHost` function to determine the target application from the request's host. An attacker could exploit this by sending a request with a forged `X-Forwarded-Host` header, causing this function to route the request to an unintended application with the victim's credentials.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.