CVE-2026-55432

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, the CreateSubAgent RPC did not validate a requested app sharing level against the template's MaxPortSharingLevel before persisting workspace apps, letting a...

CVE-2026-55432

Coder's GO/enterprise deployment vulnerability: the CreateSubAgent RPC did not validate a requested app sharing level against the template MaxPortSharingLevel before persisting workspace apps. This allowed a workspace owner (with an agent token) to exceed the administrator’s maximum, potentially ...