CVE-2026-55430
Coder ≤ 2.29.17
Raw vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:NSummary
CVE-2026-55430 is a medium-severity Insufficient Verification of Data Authenticity (CWE-345) vulnerability in Coder Coder. Its CVSS base score is 5.8 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SC-7 (Boundary Protection) and SC-8 (Transmission Confidentiality and Integrity) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-42136
Vulnerability Data
Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, the workspace app proxy resolves the target app from `httpapi.RequestHost()` which prefers the `X-Forwarded-Host` header over the real `Host` header. No middleware…
more
strips `X-Forwarded-Host` before routing and the header is not browser-forbidden so client-side JavaScript can set it on `fetch()` calls. Practical exploitation requires subdomain app routing (wildcard hostname) enabled, a victim who visits the attacker's shared app and a deployment whose upstream proxy does not strip `X-Forwarded-Host`. The fix in versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2 trusts `X-Forwarded-Host` only from configured trusted proxies and otherwise resolves the routing host from the verified request host. As a workaround, place an upstream reverse proxy that strips or overwrites `X-Forwarded-Host` on untrusted requests.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability allows an attacker to manipulate the X-Forwarded-Host header to influence workspace app proxy routing, enabling exploitation of a public-facing application (T1190) to access unintended targets when subdomain routing is enabled.
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
- 8 hardening rules · 5 OS baselines
V3.5.5V3.2.1V3.5.1V3.5.3
Mitigating Controls (NIST 800-53 r5) AI
Boundary protection at the perimeter can enforce stripping or overwriting of untrusted X-Forwarded-Host headers before they reach the Coder workspace app proxy, directly blocking the header-injection vector described in the CVE.
Requiring integrity-protected channels (TLS) between clients and the trusted reverse proxy reduces the ability of client-side JavaScript to inject spoofed X-Forwarded-Host headers over untrusted networks.
Input validation on the Host header (or explicit rejection of X-Forwarded-Host from untrusted sources) inside the application would have prevented the proxy from using attacker-controlled values for routing decisions.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Proper conveyance and verification of original identity assertions directly prevents loss of request source when forwarding.
CWE-345 directly impairs RC.RP-05's verification of restored-asset integrity/authenticity, largely defeating the outcome while still leaving other restoration-confirmation steps partially viable.
Enforcing least-privilege authorizations on forwarded requests reduces confused-deputy abuse even if source identity is lost.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect missing or weak data authenticity verification.
Access-control rules can limit which upstream identities may cause the product to act on their behalf, reducing confused-deputy risk.
Proper identity management ensures the original requester identity is preserved and validated before the product forwards requests.
Explicit access-rights assignment can restrict the product’s ability to act as an unintended proxy for external actors.
Privileged-access controls limit the rights the product may exercise on behalf of upstream callers, mitigating confused-deputy abuse.
Network controls can enforce authenticated channels, reducing risk of accepting unauthentic data.