Read the docs
TI-2026-33531 Aliases CVE-2026-45796GHSA-686c-7vgv-v3fx

Coder vulnerable to unauthenticated SSRF via Azure Instance Identity Endpoint

Priority LOW 35CWE-918Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

Coder allows organizations to provision remote development environments via Terraform. Versions prior tp 2.24.5, 2.29.13, 2.30.8, 2.31.12, 2.32.2, and 2.33.3 are vulnerable to unauthenticated semi-blind Server-Side Request Forgery (SSRF) via the Azure instance identity endpoint (`POST /api/v2/workspaceagents/azure-instance-identity`). An external attacker can force the Coder server to issue HTTP GET requests to arbitrary internal or external hosts by submitting a crafted PKCS#7 signature. The server does not return the target's response body, but error messages in the API response reveal whether the target is reachable and what type of failure occurred. Versions 2.24.5, 2.29.13, 2.30.8, 2.31.12, 2.32.2, and 2.33.3 patch the issue. As a workaround, if the Azure identity-auth mechanism is not being used then restrict access to the corresponding endpoint (`/api/v2/workspaceagents/azure-instance-identity`) using ingress firewall and/or proxy ACLs.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0043 37th percentileScored 2026-11-07
Fix Fixed coder (coder): 2.33.3, 2.32.2, 2.31.12 +3github.com/coder/coder/v2 (Go): 2.33.3, 2.32.2, 2.31.12 +3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
codercoder2.33.0-rc.0 to before 2.33.3; 2.32.0-rc.0 to before 2.32.2; 2.31.0 to before 2.31.12; 2.30.0 to before 2.30.8; 2.29.0 to before 2.29.13; before 2.24.52.33.3, 2.32.2, 2.31.12, 2.30.8, 2.29.13, 2.24.5Patch availableCNA
—github.com/coder/coder/v2 (Go)2.33.0-rc.0 to before 2.33.32.33.3Patch availableGHSA-686c-7vgv-v3fx
—github.com/coder/coder/v2 (Go)2.32.0-rc.0 to before 2.32.22.32.2Patch availableGHSA-686c-7vgv-v3fx
—github.com/coder/coder/v2 (Go)2.31.0 to before 2.31.122.31.12Patch availableGHSA-686c-7vgv-v3fx
—github.com/coder/coder/v2 (Go)2.30.0 to before 2.30.82.30.8Patch availableGHSA-686c-7vgv-v3fx
—github.com/coder/coder/v2 (Go)2.29.0 to before 2.29.132.29.13Patch availableGHSA-686c-7vgv-v3fx
—github.com/coder/coder/v2 (Go)before 2.24.52.24.5Patch availableGHSA-686c-7vgv-v3fx
—github.com/coder/coder (Go)up to 0.27.3—No fix listedGHSA-686c-7vgv-v3fx
  • coder Vendorcoder Affected 2.33.0-rc.0 to before 2.33.3; 2.32.0-rc.0 to before 2.32.2; 2.31.0 to before 2.31.12; 2.30.0 to before 2.30.8; 2.29.0 to before 2.29.13; before 2.24.5 Fixed in 2.33.3, 2.32.2, 2.31.12, 2.30.8, 2.29.13, 2.24.5 Patch available CNA
  • github.com/coder/coder/v2 (Go) Vendor— Affected 2.33.0-rc.0 to before 2.33.3 Fixed in 2.33.3 Patch available GHSA-686c-7vgv-v3fx
  • github.com/coder/coder/v2 (Go) Vendor— Affected 2.32.0-rc.0 to before 2.32.2 Fixed in 2.32.2 Patch available GHSA-686c-7vgv-v3fx
  • github.com/coder/coder/v2 (Go) Vendor— Affected 2.31.0 to before 2.31.12 Fixed in 2.31.12 Patch available GHSA-686c-7vgv-v3fx
  • github.com/coder/coder/v2 (Go) Vendor— Affected 2.30.0 to before 2.30.8 Fixed in 2.30.8 Patch available GHSA-686c-7vgv-v3fx
  • github.com/coder/coder/v2 (Go) Vendor— Affected 2.29.0 to before 2.29.13 Fixed in 2.29.13 Patch available GHSA-686c-7vgv-v3fx
  • github.com/coder/coder/v2 (Go) Vendor— Affected before 2.24.5 Fixed in 2.24.5 Patch available GHSA-686c-7vgv-v3fx
  • github.com/coder/coder (Go) Vendor— Affected up to 0.27.3 Fixed in — No fix listed GHSA-686c-7vgv-v3fx

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:coder:coder:*:*:*:*:*:go:*:*before 2.24.5; 2.29.0 to before 2.29.13; 2.30.0 to before 2.30.8; 2.31.0 to before 2.31.12; 2.32.0 to before 2.32.2; 2.33.0 to before 2.33.3Vulnerablecoder
  • cpe:2.3:a:coder:coder:*:*:*:*:*:go:*:* Versions before 2.24.5; 2.29.0 to before 2.29.13; 2.30.0 to before 2.30.8; 2.31.0 to before 2.31.12; 2.32.0 to before 2.32.2; 2.33.0 to before 2.33.3 Vulnerable ·coder

Remediation

  • Fix · CNA coder (coder) Fixed in 2.33.3, 2.32.2, 2.31.12, 2.30.8, 2.29.13, 2.24.5
  • Fix · GHSA-686c-7vgv-v3fx github.com/coder/coder/v2 (Go) Fixed in 2.33.3 Advisory →
  • Fix · GHSA-686c-7vgv-v3fx github.com/coder/coder/v2 (Go) Fixed in 2.32.2 Advisory →
  • Fix · GHSA-686c-7vgv-v3fx github.com/coder/coder/v2 (Go) Fixed in 2.31.12 Advisory →
  • Fix · GHSA-686c-7vgv-v3fx github.com/coder/coder/v2 (Go) Fixed in 2.30.8 Advisory →
  • Fix · GHSA-686c-7vgv-v3fx github.com/coder/coder/v2 (Go) Fixed in 2.29.13 Advisory →
  • Fix · GHSA-686c-7vgv-v3fx github.com/coder/coder/v2 (Go) Fixed in 2.24.5 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-45796
  2. 2026-10-03 Alias added: GHSA-686c-7vgv-v3fx

References

Patch 3

Other 7

  • TI-2026-34071 Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft CVSS 3.1CRITICAL 9.1
  • TI-2026-32394 Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent CVSS 3.1HIGH 8.8
  • TI-2024-18523 Coder's OIDC authentication allows email with partially matching domain to register CVSS 3.1HIGH 8.2
  • TI-2026-39997 Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID CVSS 3.1HIGH 8.7
  • TI-2026-39996 Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator CVSS 3.1HIGH 8.2
  • TI-2026-39995 Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` CVSS 3.1HIGH 8.3
See all 22 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences