TI-2026-34071 Aliases CVE-2026-46354 GHSA-6x44-w3xg-hqqf

Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft

MEDIUM 47CWE-347Published 2026-07-07 · Updated 2026-07-08

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-347.

Summary

Coder allows organizations to provision remote development environments via Terraform. In versions prior tp 2.24.5, 2.29.13, 2.30.8, 2.31.12, 2.32.2, and 2.33.3, `azureidentity.Validate()` verifies that the PKCS#7 signer certificate chains to a trusted Azure CA but never verifies the PKCS#7 signature itself. An attacker can embed a legitimate Azure certificate alongside arbitrary content e.g. `{"vmId":"<target>"}` and the forged `vmId` will be accepted returning the victim workspace agent's session token. No authentication is required. The attacker only needs to know a target VM's `vmId` which is a `UUIDv4`. That's a practical limitation which would typically require prior access to be exploited. Versions 2.24.5, 2.29.13, 2.30.8, 2.31.12, 2.32.2, and 2.33.3 patch the issue. As a workaround, reconfigure any Azure templates to use token authentication rather than `azure-instance-identity`.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00318 24th percentileScored 2026-11-07

Fix Fixed coder (coder): 2.33.3, 2.32.2, 2.31.12 +3github.com/coder/coder/v2 (Go): 2.33.3, 2.32.2, 2.31.12 +3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
coder	coder	2.33.0-rc.0 to before 2.33.3; 2.32.0-rc.0 to before 2.32.2; 2.31.0 to before 2.31.12; 2.30.0 to before 2.30.8; 2.29.0 to before 2.29.13; before 2.24.5	2.33.3, 2.32.2, 2.31.12, 2.30.8, 2.29.13, 2.24.5	Patch available	CNA
—	github.com/coder/coder/v2 (Go)	2.33.0-rc.0 to before 2.33.3	2.33.3	Patch available	GHSA-6x44-w3xg-hqqf
—	github.com/coder/coder/v2 (Go)	2.32.0-rc.0 to before 2.32.2	2.32.2	Patch available	GHSA-6x44-w3xg-hqqf
—	github.com/coder/coder/v2 (Go)	2.31.0 to before 2.31.12	2.31.12	Patch available	GHSA-6x44-w3xg-hqqf
—	github.com/coder/coder/v2 (Go)	2.30.0 to before 2.30.8	2.30.8	Patch available	GHSA-6x44-w3xg-hqqf
—	github.com/coder/coder/v2 (Go)	2.29.0 to before 2.29.13	2.29.13	Patch available	GHSA-6x44-w3xg-hqqf
—	github.com/coder/coder/v2 (Go)	before 2.24.5	2.24.5	Patch available	GHSA-6x44-w3xg-hqqf
—	github.com/coder/coder (Go)	up to 0.27.3	—	No fix listed	GHSA-6x44-w3xg-hqqf

coder Vendorcoder Affected 2.33.0-rc.0 to before 2.33.3; 2.32.0-rc.0 to before 2.32.2; 2.31.0 to before 2.31.12; 2.30.0 to before 2.30.8; 2.29.0 to before 2.29.13; before 2.24.5 Fixed in 2.33.3, 2.32.2, 2.31.12, 2.30.8, 2.29.13, 2.24.5 Patch available CNA
github.com/coder/coder/v2 (Go) Vendor— Affected 2.33.0-rc.0 to before 2.33.3 Fixed in 2.33.3 Patch available GHSA-6x44-w3xg-hqqf
github.com/coder/coder/v2 (Go) Vendor— Affected 2.32.0-rc.0 to before 2.32.2 Fixed in 2.32.2 Patch available GHSA-6x44-w3xg-hqqf
github.com/coder/coder/v2 (Go) Vendor— Affected 2.31.0 to before 2.31.12 Fixed in 2.31.12 Patch available GHSA-6x44-w3xg-hqqf
github.com/coder/coder/v2 (Go) Vendor— Affected 2.30.0 to before 2.30.8 Fixed in 2.30.8 Patch available GHSA-6x44-w3xg-hqqf
github.com/coder/coder/v2 (Go) Vendor— Affected 2.29.0 to before 2.29.13 Fixed in 2.29.13 Patch available GHSA-6x44-w3xg-hqqf
github.com/coder/coder/v2 (Go) Vendor— Affected before 2.24.5 Fixed in 2.24.5 Patch available GHSA-6x44-w3xg-hqqf
github.com/coder/coder (Go) Vendor— Affected up to 0.27.3 Fixed in — No fix listed GHSA-6x44-w3xg-hqqf

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:coder:coder::::::go::*	before 2.24.5; 2.29.0 to before 2.29.13; 2.30.0 to before 2.30.8; 2.31.0 to before 2.31.12; 2.32.0 to before 2.32.2; 2.33.0 to before 2.33.3	Vulnerable	coder

cpe:2.3:a:coder:coder:*:*:*:*:*:go:*:* Versions before 2.24.5; 2.29.0 to before 2.29.13; 2.30.0 to before 2.30.8; 2.31.0 to before 2.31.12; 2.32.0 to before 2.32.2; 2.33.0 to before 2.33.3 Vulnerable ·coder

Remediation

Fix · CNA coder (coder) Fixed in 2.33.3, 2.32.2, 2.31.12, 2.30.8, 2.29.13, 2.24.5
Fix · GHSA-6x44-w3xg-hqqf github.com/coder/coder/v2 (Go) Fixed in 2.33.3 Advisory →
Fix · GHSA-6x44-w3xg-hqqf github.com/coder/coder/v2 (Go) Fixed in 2.32.2 Advisory →
Fix · GHSA-6x44-w3xg-hqqf github.com/coder/coder/v2 (Go) Fixed in 2.31.12 Advisory →
Fix · GHSA-6x44-w3xg-hqqf github.com/coder/coder/v2 (Go) Fixed in 2.30.8 Advisory →
Fix · GHSA-6x44-w3xg-hqqf github.com/coder/coder/v2 (Go) Fixed in 2.29.13 Advisory →
Fix · GHSA-6x44-w3xg-hqqf github.com/coder/coder/v2 (Go) Fixed in 2.24.5 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-46354
2026-10-03 Alias added: GHSA-6x44-w3xg-hqqf

References

Patch 2

Other 7

TI-2026-32394 Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent CVSS 3.1HIGH 8.8
TI-2024-18523 Coder's OIDC authentication allows email with partially matching domain to register CVSS 3.1HIGH 8.2
TI-2026-39997 Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID CVSS 3.1HIGH 8.7
TI-2026-39996 Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator CVSS 3.1HIGH 8.2
TI-2026-39995 Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` CVSS 3.1HIGH 8.3
TI-2025-36196 Coder's privilege escalation vulnerability could lead to a cross workspace compromise CVSS 3.1HIGH 8.1

See all 22 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences