coder

v2.32.7 Security

This release includes 5 security fixes for security teams reviewing exposed deployments.

Published 1mo Developer Productivity

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

This release patches 5 known CVEs

Topics

agents dev-tools development-environment go ide jetbrains

+3 more

remote-development terraform vscode

Affected surfaces

auth rbac

Summary

AI summary

BREAKING CHANGES in OIDC handling, HostnameSuffix validation, and x‑forwarded‑host trust; multiple bug fixes across Server, Agent, and Container image updates.

Full changelog

Changelog

BREAKING CHANGES

fix(coderd)!: restrict OIDC email fallback to first-time account linking (#25712, 670cd427c8)
fix!: reject OIDC login when email_verified claim is non-bool or absent (#25713, 0fbee8f9a6)
fix!: validate HostnameSuffix and SSHConfigOptions' (#26154, 2dcde52462) (@johnstcn)
fix!: only trust x-forwarded-host from configured trusted proxies (conflicts) (#26204, a992c2c9d7) (@geokat)

Bug fixes

Clamp template port sharing level in SubAgentAPI (#26061, 5621b756e8)
Use a random value for a simulated hash for built-in users (#26205, 027cf9af16) (@sreya)
Require update permission to recreate devcontainers (#25812, cc895f6f78)
Escape agent log HTML (#25808, d3e330c02b)
Escape appearance values in HTML output (#25804, 74f08d17e9)
Server: Verify workspace owner matches app username (#26085, 4c968b6fb9) (@geokat)
Server: Prevent cross-tenant workspace app rebinding (#26103, 8e0a083e56) (@dylanhuff-at-coder)
Agent: Prevent command injection in shell execer (#26235, 94ee8fb4b4) (@zedkipp)
Validate agent-supplied AllowedIPs in coordinator (#26144, fa933af8f8) (@f0ssel)
Prevent session token exfiltration via external app URLs (#26146, 37332e6e7d) (@zedkipp)
Server: Prevent user-admin from resetting owner password (#25709, 931d4fa53b)
Reject oversized and invalid zip uploads (#25877, 1f6ccf93e8)
Validate FileSize in NewDataBuilder to prevent OOM DoS (#25710, 2cabbc3f3d)
Rename bundled rstudio.svg to rproject.svg, add real RStudio icon (#26216, eb297f3e1a) (@nickvigilante)
Check user user is active in aibridge auth (conflicts) (#26173, 5114fd4ff2) (@pawbana)
Always verify TLS on aibridgeproxyd upstream transport (#26131, 0374b00b63) (@ssncferreira)

Chores

Backport release action (#26143, 7ef82012a3)

Compare: v2.32.6...v2.32.7

Container image

docker pull ghcr.io/coder/coder:2.32.7

Install/upgrade

Refer to our docs to install or upgrade Coder, or use a release asset below.

Breaking Changes

Restrict OIDC email fallback to first‑time account linking (coderd)
Reject OIDC login when email_verified claim is non‑bool or absent
Validate HostnameSuffix and SSHConfigOptions
Only trust x-forwarded-host from configured trusted proxies

Security Fixes

Prevent session token exfiltration via external app URLs
Agent: Prevent command injection in shell execer
Validate agent‑supplied AllowedIPs in coordinator
Reject oversized and invalid zip uploads
Validate FileSize in NewDataBuilder to prevent OOM DoS

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track coder

Get notified when new releases ship.

About coder

Secure environments for developers and their agents

All releases →

Related context

Related tools

Earlier breaking changes

v2.29.17 Validate HostnameSuffix and SSHConfigOptions
v2.29.17 Reject OIDC login when email_verified claim is non-bool or absent
v2.29.17 Restrict OIDC email fallback to first-time account linking
v2.29.17 Only trust x-forwarded-host from configured trusted proxies