CVE-2026-55428 Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator

🗓️ 07 Jul 2026 23:57:45Reported by GitHub_MType

Route hijacking from unvalidated AllowedIPs by agents in the tailnet coordinator; fix validates AllowedIPs by agent identifier.

Reporter	Title	Published	Views	Family All 14
Circl	CVE-2026-55428	8 Jul 202603:31	–	circl
Tenable Nessus	Coder < 2.29.17 / 2.30.x < 2.32.7 / 2.33.x < 2.33.8 / 2.34.x < 2.34.2 Multiple Vulnerabilities	10 Jul 202600:00	–	nessus
CVE	CVE-2026-55428	7 Jul 202623:57	–	cve
Cvelist	CVE-2026-55428 Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator	7 Jul 202623:57	–	cvelist
Github Security Blog	Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator	6 Jul 202620:58	–	github
NVD	CVE-2026-55428	8 Jul 202600:16	–	nvd
OSV	GHSA-WRQ8-FCV5-8HVP Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator	6 Jul 202620:58	–	osv
OSV	GO-2026-5915 Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator in github.com/coder/coder	7 Jul 202615:26	–	osv
OSV	OPENSUSE-SU-2026:21483-1 Security update for govulncheck-vulndb	30 Jul 202609:09	–	osv
Positive Technologies	PT-2026-56072	6 Jul 202600:00	–	ptsecurity

Source	Link
github	www.github.com/coder/coder/security/advisories/GHSA-wrq8-fcv5-8hvp
github	www.github.com/coder/coder/releases/tag/v2.29.17
github	www.github.com/coder/coder/releases/tag/v2.33.8
github	www.github.com/coder/coder/releases/tag/v2.32.7
github	www.github.com/coder/coder/pull/26144
github	www.github.com/coder/coder/releases/tag/v2.34.2

07 Jul 2026 23:57Current

6Medium risk

Vulners AI Score6

CVSS 3.18.2

EPSS0.00405

SSVC