CVE-2026-55428CWE-285CWE-863

Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator

High · published July 7, 2026

CVSS v3.1
8.2
EPSS
0%
Percentile
33.6
In the wild
Unconfirmed
What it is

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, the tailnet coordinator validates that an agent's `Addresses` derive from its authenticated UUID but applies no equivalent check to `AllowedIPs`. The coordinator forwards agent-supplied `AllowedIPs` verbatim to tunnel peers which install them into the WireGuard peer configuration. The fix in versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2 validates each `AllowedIPs` prefix against the authenticating agent's UUID just like `Addresses`. As a workaround, monitor coordinator logs for agents advertising unexpected `AllowedIPs` prefixes.

The record
Technical detail
CVSS v3.1
8.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00405 · 33.6th percentile
Weaknesses
CWE-285 · Improper Authorization; CWE-863 · Incorrect Authorization
Published
2026-07-07T23:57Z
EPSS history
Timeline
  • 07 JUL 23:57Z
    Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator
    cvelistv5