Coder allows organizations to provision remote development environments via Terraform. Starting in version 2.30.0 and prior to versions 2.32.7, 2.33.8, and 2.34…

CVE-2026-55436 affects Coder, a platform for provisioning remote development environments via Terraform. Versions 2.30.0 through before 2.32.7, 2.33.8, and 2.34.2 contain a critical TLS misconfiguration in the AI Bridge Proxy (aibridgeproxyd). The proxy's goproxy server defaulted to InsecureSkipVerify: true, meaning outbound HTTPS connections to the Coder access URL would accept any TLS certificate when no upstream proxy was configured. This makes the component vulnerable to man-in-the-middle (MITM) attacks where an attacker with an on-path network position could intercept or tamper with communications. Deployments where the proxy and Coder server are co-located on loopback are effectively unaffected. Fixed versions enforce TLS 1.2 or higher with system root CAs unconditionally. Workarounds include using trusted certificates and securing the network path via loopback or mTLS.