Summary
UpsertWorkspaceApp overwrites an existing app's agent_id on a primary-key conflict and insertAgentApp accepts the app ID from the provisioner's CompleteJob payload without verifying it belongs to the workspace being built. CompleteJob runs under dbauthz.AsProvisionerd so the authorization layer does not block the cross-workspace upsert.
Note: Exploitation requires elevated access as a template author or external provisioner operator.
Impact
A user with template authorship or external provisioner access can submit a CompleteJob payload with a known victim app UUID and an attacker-controlled agent ID. On completion of the attacker's build the victim's app row is rebound to the attacker's agent so later app traffic such as IDE and terminal sessions is proxied to the attacker's workspace. App UUIDs are discoverable through the public API.
Patches
The fix verifies that any existing workspace_apps row matching the supplied ID belongs to the workspace being built and rejects cross-workspace agent reassignment.
The fix was backported to all supported release lines:
Workarounds
None. Upgrading is required.
Resources
Credits
Coder would like to thank Anthropic's Security Team (ANT-2026-22441) for independently disclosing this issue!
References
Summary
UpsertWorkspaceAppoverwrites an existing app'sagent_idon a primary-key conflict andinsertAgentAppaccepts the app ID from the provisioner'sCompleteJobpayload without verifying it belongs to the workspace being built.CompleteJobruns underdbauthz.AsProvisionerdso the authorization layer does not block the cross-workspace upsert.Impact
A user with template authorship or external provisioner access can submit a
CompleteJobpayload with a known victim app UUID and an attacker-controlled agent ID. On completion of the attacker's build the victim's app row is rebound to the attacker's agent so later app traffic such as IDE and terminal sessions is proxied to the attacker's workspace. App UUIDs are discoverable through the public API.Patches
The fix verifies that any existing
workspace_appsrow matching the supplied ID belongs to the workspace being built and rejects cross-workspace agent reassignment.The fix was backported to all supported release lines:
Workarounds
None. Upgrading is required.
Resources
Credits
Coder would like to thank Anthropic's Security Team (ANT-2026-22441) for independently disclosing this issue!
References