tocsin

Go/github.com/coder/coder/v2 CVE-2026-55431: high 7.7, EPSS 0.34%

Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps

Action: Upgrade github.com/coder/coder/v2 to 2.29.17 or later.

go get github.com/coder/coder/v2@v2.34.2
go get github.com/coder/coder/v2@v2.33.8
go get github.com/coder/coder/v2@v2.32.7
go get github.com/coder/coder/v2@v2.29.17

Affected

introducedfixedlast affected
2.34.02.34.2-
2.33.02.33.8-
2.30.02.32.7-
02.29.17-

Fixed versions

2.34.22.33.82.32.72.29.17

Sources

CVE-2026-55431 · published · modified · JSON