Описание
Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID
Summary
UpsertWorkspaceApp overwrites an existing app's agent_id on a primary-key conflict and insertAgentApp accepts the app ID from the provisioner's CompleteJob payload without verifying it belongs to the workspace being built. CompleteJob runs under dbauthz.AsProvisionerd so the authorization layer does not block the cross-workspace upsert.
Note: Exploitation requires elevated access as a template author or external provisioner operator.
Impact
A user with template authorship or external provisioner access can submit a CompleteJob payload with a known victim app UUID and an attacker-controlled agent ID. On completion of the attacker's build the victim's app row is rebound to the attacker's agent so later app traffic such as IDE and terminal sessions is proxied to the attacker's workspace. App UUIDs are discoverable through the public API.
Patches
The fix verifies that any existing workspace_apps row matching the supplied ID belongs to the workspace being built and rejects cross-workspace agent reassignment.
The fix was backported to all supported release lines:
Workarounds
None. Upgrading is required.
Resources
- Fix: #26103
Credits
Coder would like to thank Anthropic's Security Team (ANT-2026-22441) for independently disclosing this issue!
Пакеты
github.com/coder/coder/v2
>= 2.34.0, < 2.34.2
2.34.2
github.com/coder/coder/v2
>= 2.33.0, < 2.33.8
2.33.8
github.com/coder/coder/v2
>= 2.30.0, < 2.32.7
2.32.7
github.com/coder/coder/v2
< 2.29.17
2.29.17
Связанные уязвимости
Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, `UpsertWorkspaceApp` overwrites an existing app's `agent_id` on a primary-key conflict and `insertAgentApp` accepts the app ID from the provisioner's `CompleteJob` payload without verifying it belongs to the workspace being built. `CompleteJob` runs under `dbauthz.AsProvisionerd` so the authorization layer does not block the cross-workspace upsert. Exploitation requires elevated access as a template author or external provisioner operator. The fix in versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2 verifies that any existing `workspace_apps` row matching the supplied ID belongs to the workspace being built and rejects cross-workspace agent reassignment. No known workarounds are available.