CVE-2026-55435: Suspended Coder users retain access to AI Bridge LLM proxy endpoints
(updated )
AI Bridge proxy endpoints authenticate via Server.IsAuthorized in coderd/aibridgedserver, which validates key format, expiry, secret and deleted or system users but does not check whether the account is suspended. Because suspension does not revoke existing API keys, a suspended user’s unexpired token keeps working.
Note: Practical impact is limited to already-issued API keys of suspended users until those keys are deleted.
References
- github.com/advisories/GHSA-wqxv-w64v-5wh6
- github.com/coder/coder/commit/0d2c9f904a8b75b888140fcc8fbf4633660cc787
- github.com/coder/coder/pull/26164
- github.com/coder/coder/pull/26173
- github.com/coder/coder/releases/tag/v2.32.7
- github.com/coder/coder/releases/tag/v2.33.8
- github.com/coder/coder/releases/tag/v2.34.2
- github.com/coder/coder/security/advisories/GHSA-wqxv-w64v-5wh6
- nvd.nist.gov/vuln/detail/CVE-2026-55435
Code Behaviors & Features
Detect and mitigate CVE-2026-55435 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →