CVE-2026-55431— Coder `open app` 命令泄露会话令牌
新しい脆弱性情報の通知を購読するログインして購読
I. CVE-2026-55431の基本情報
脆弱性情報
脆弱性についてご質問がありますか？Shenlongの分析が参考になるかご確認ください！
Shenlongの10の質問を表示 ↗ 高度な大規模言語モデル技術を使用していますが、出力には不正確または古い情報が含まれる可能性があります。Shenlongはデータの正確性を確保するよう努めていますが、実際の状況に基づいて検証・判断してください。
脆弱性タイトル
Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps
ソース: NVD (National Vulnerability Database)
脆弱性説明
Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, `coder open app` opens external workspace-app URLs without validating the scheme or host. When an external app URL contains the `$SESSION_TOKEN` placeholder the CLI replaces it with the user's real session token before handing the URL to the OS open handler. Practical exploitation requires the victim to run `coder open app` against a workspace whose external app definition the attacker controls. Only a malicious template author can control external app URLs. The fix in versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2 applies a URL-scheme allowlist in the CLI and limits `$SESSION_TOKEN` substitution to trusted destinations like the web frontend. As a workaround, avoid running `coder open app` for untrusted workspaces.
ソース: NVD (National Vulnerability Database)
CVSS情報
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N
ソース: NVD (National Vulnerability Database)
脆弱性タイプ
不充分的凭证保护机制
ソース: NVD (National Vulnerability Database)
影響を受ける製品
II. CVE-2026-55431の公開POC
| # | POC説明 | ソースリンク | Shenlongリンク |
|---|
AI生成POCプレミアム
公開POCは見つかりませんでした。
ログインしてAI POCを生成III. CVE-2026-55431のインテリジェンス情報
请登录查看更多情报信息。
CVE-2026-55431 补丁与修复 (1)
CVE-2026-55431 厂商安全公告 (1)
CVE-2026-55431 厂商页面 (4)
Same Patch Batch · coder · 2026-07-08 · 8 CVEs total
| CVE-2026-55429 | 8.7 HIGH | Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled ap |
| CVE-2026-55436 | 7.4 HIGH | Coder's AI Bridge Proxy skips TLS certificate verification in default configuration |
| CVE-2026-55438 | 5.8 MEDIUM | Coder's workspace app CORS origin check can be bypassed via UUID-based subdomain spoofing |
| CVE-2026-55430 | 5.8 MEDIUM | Coder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, en |
| CVE-2026-55437 | 5.4 MEDIUM | Coder vulnerable to stored HTML injection via workspace agent logs in AgentLogLine compone |
| CVE-2026-55432 | 5.4 MEDIUM | Coder's sub-agent app registration bypasses template port-sharing policy enforcement |
| CVE-2026-55433 | 5.4 MEDIUM | Coder: Devcontainer recreate endpoint missing write authorization allows read-only roles t |
IV. 関連脆弱性
同じ製品: coder
- CVE-2026-55438
Coder's workspace app CORS origin check can be bypassed via - CVE-2026-55437
Coder vulnerable to stored HTML injection via workspace agen - CVE-2026-55436
Coder's AI Bridge Proxy skips TLS certificate verification i - CVE-2026-55433
Coder: Devcontainer recreate endpoint missing write authoriz - CVE-2026-55432
Coder's sub-agent app registration bypasses template port-sh
同じベンダー: coder
- CVE-2026-55438
Coder's workspace app CORS origin check can be bypassed via - CVE-2026-55437
Coder vulnerable to stored HTML injection via workspace agen - CVE-2026-55436
Coder's AI Bridge Proxy skips TLS certificate verification i - CVE-2026-55433
Coder: Devcontainer recreate endpoint missing write authoriz - CVE-2026-55432
Coder's sub-agent app registration bypasses template port-sh
同じ弱点: CWE-522
- CVE-2026-59209
n8n: Shared Credential Header Leak via HTTP Request Paginati - CVE-2026-11827
Insufficiently Protected Credentials in GitLab - CVE-2026-56843
Plesk <18.0.78.4 越权访问导致凭证泄露 - CVE-2026-7017
HTTP::Tiny versions before 0.095 for Perl forward credential - CVE-2026-44938
Fleet has PSS Bypass through addLabelsFromOptions in Fleet A
V. CVE-2026-55431へのコメント
まだコメントはありません