Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID

Overview

Summary

UpsertWorkspaceApp overwrites an existing app's agent_id on a primary-key conflict and insertAgentApp accepts the app ID from the provisioner's CompleteJob payload without verifying it belongs to the workspace being built. CompleteJob runs under dbauthz.AsProvisionerd so the authorization layer does not block the cross-workspace upsert.

Note: Exploitation requires elevated access as a template author or external provisioner operator.

Impact

A user with template authorship or external provisioner access can submit a CompleteJob payload with a known victim app UUID and an attacker-controlled agent ID. On completion of the attacker's build the victim's app row is rebound to the attacker's agent so later app traffic such as IDE and terminal sessions is proxied to the attacker's workspace. App UUIDs are discoverable through the public API.

Patches

The fix verifies that any existing workspace_apps row matching the supplied ID belongs to the workspace being built and rejects cross-workspace agent reassignment.

The fix was backported to all supported release lines:

Workarounds

None. Upgrading is required.

Resources

• Fix: #26103

Credits

Coder would like to thank Anthropic's Security Team (ANT-2026-22441) for independently disclosing this issue!

Affected packages

• github.com/coder/coder/v2 >= 2.34.0, < 2.34.2
• github.com/coder/coder/v2 >= 2.33.0, < 2.33.8
• github.com/coder/coder/v2 >= 2.30.0, < 2.32.7
• github.com/coder/coder/v2 < 2.29.17

Remediation

Upgrade to a patched release:

• github.com/coder/coder/v2 2.34.2
• github.com/coder/coder/v2 2.33.8
• github.com/coder/coder/v2 2.32.7
• github.com/coder/coder/v2 2.29.17