Shodan
Vulnerabilities
Vulnerable Software

Vulnerability Details CVE-2026-55435

Coder allows organizations to provision remote development environments via Terraform. Starting in version 2.30.0 and prior to versions 2.32.7, 2.33.8, and 2.34.2, AI Bridge proxy endpoints authenticate via `Server.IsAuthorized` in `coderd/aibridgedserver`, which validates key format, expiry, secret and deleted or system users but does not check whether the account is suspended. Because suspension does not revoke existing API keys, a suspended user's unexpired token keeps working. Practical impact is limited to already-issued API keys of suspended users until those keys are deleted. Versions 2.32.7, 2.33.8, and 2.34.2 patch the issue. As a workaround, on suspension, delete the user's API keys via `DELETE /api/v2/users/{user}/keys`.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.003
EPSS Ranking 23.9%
CVSS Severity
CVSS v3 Score 5.4
Products affected by CVE-2026-55435
  • Coder » Coder » Version: 2.30.0
    cpe:2.3:a:coder:coder:2.30.0
  • Coder » Coder » Version: 2.30.1
    cpe:2.3:a:coder:coder:2.30.1
  • Coder » Coder » Version: 2.30.2
    cpe:2.3:a:coder:coder:2.30.2
  • Coder » Coder » Version: 2.30.3
    cpe:2.3:a:coder:coder:2.30.3
  • Coder » Coder » Version: 2.30.4
    cpe:2.3:a:coder:coder:2.30.4
  • Coder » Coder » Version: 2.30.5
    cpe:2.3:a:coder:coder:2.30.5
  • Coder » Coder » Version: 2.30.6
    cpe:2.3:a:coder:coder:2.30.6
  • Coder » Coder » Version: 2.30.7
    cpe:2.3:a:coder:coder:2.30.7
  • Coder » Coder » Version: 2.30.8
    cpe:2.3:a:coder:coder:2.30.8
  • Coder » Coder » Version: 2.30.9
    cpe:2.3:a:coder:coder:2.30.9
  • Coder » Coder » Version: 2.31.0
    cpe:2.3:a:coder:coder:2.31.0
  • Coder » Coder » Version: 2.31.1
    cpe:2.3:a:coder:coder:2.31.1
  • Coder » Coder » Version: 2.31.10
    cpe:2.3:a:coder:coder:2.31.10
  • Coder » Coder » Version: 2.31.11
    cpe:2.3:a:coder:coder:2.31.11
  • Coder » Coder » Version: 2.31.12
    cpe:2.3:a:coder:coder:2.31.12
  • Coder » Coder » Version: 2.31.13
    cpe:2.3:a:coder:coder:2.31.13
  • Coder » Coder » Version: 2.31.14
    cpe:2.3:a:coder:coder:2.31.14
  • Coder » Coder » Version: 2.31.2
    cpe:2.3:a:coder:coder:2.31.2
  • Coder » Coder » Version: 2.31.3
    cpe:2.3:a:coder:coder:2.31.3
  • Coder » Coder » Version: 2.31.4
    cpe:2.3:a:coder:coder:2.31.4
  • Coder » Coder » Version: 2.31.5
    cpe:2.3:a:coder:coder:2.31.5
  • Coder » Coder » Version: 2.31.6
    cpe:2.3:a:coder:coder:2.31.6
  • Coder » Coder » Version: 2.31.7
    cpe:2.3:a:coder:coder:2.31.7
  • Coder » Coder » Version: 2.31.8
    cpe:2.3:a:coder:coder:2.31.8
  • Coder » Coder » Version: 2.31.9
    cpe:2.3:a:coder:coder:2.31.9
  • Coder » Coder » Version: 2.32.0
    cpe:2.3:a:coder:coder:2.32.0
  • Coder » Coder » Version: 2.32.1
    cpe:2.3:a:coder:coder:2.32.1
  • Coder » Coder » Version: 2.32.2
    cpe:2.3:a:coder:coder:2.32.2
  • Coder » Coder » Version: 2.32.3
    cpe:2.3:a:coder:coder:2.32.3
  • Coder » Coder » Version: 2.32.4
    cpe:2.3:a:coder:coder:2.32.4
  • Coder » Coder » Version: 2.32.5
    cpe:2.3:a:coder:coder:2.32.5
  • Coder » Coder » Version: 2.32.6
    cpe:2.3:a:coder:coder:2.32.6
  • Coder » Coder » Version: 2.33.0
    cpe:2.3:a:coder:coder:2.33.0
  • Coder » Coder » Version: 2.33.1
    cpe:2.3:a:coder:coder:2.33.1
  • Coder » Coder » Version: 2.33.2
    cpe:2.3:a:coder:coder:2.33.2
  • Coder » Coder » Version: 2.33.3
    cpe:2.3:a:coder:coder:2.33.3
  • Coder » Coder » Version: 2.33.4
    cpe:2.3:a:coder:coder:2.33.4
  • Coder » Coder » Version: 2.33.5
    cpe:2.3:a:coder:coder:2.33.5
  • Coder » Coder » Version: 2.33.6
    cpe:2.3:a:coder:coder:2.33.6
  • Coder » Coder » Version: 2.33.7
    cpe:2.3:a:coder:coder:2.33.7
  • Coder » Coder » Version: 2.34.0
    cpe:2.3:a:coder:coder:2.34.0
  • Coder » Coder » Version: 2.34.1
    cpe:2.3:a:coder:coder:2.34.1


Products
Pricing
Contact Us

Shodan ® - All rights reserved