CVE-2026-55428: Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator

July 6, 2026

The tailnet coordinator validates that an agent’s Addresses derive from its authenticated UUID but applies no equivalent check to AllowedIPs. The coordinator forwards agent-supplied AllowedIPs verbatim to tunnel peers which install them into the WireGuard peer configuration.

References

github.com/advisories/GHSA-wrq8-fcv5-8hvp
github.com/coder/coder/pull/26144
github.com/coder/coder/security/advisories/GHSA-wrq8-fcv5-8hvp
nvd.nist.gov/vuln/detail/CVE-2026-55428

Code Behaviors & Features

Detect and mitigate CVE-2026-55428 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →