6.5

CVE-2026-45796

Coder vulnerable to unauthenticated SSRF via Azure Instance Identity Endpoint

Coder allows organizations to provision remote development environments via Terraform. Versions prior tp 2.24.5, 2.29.13, 2.30.8, 2.31.12, 2.32.2, and 2.33.3 are vulnerable to unauthenticated semi-blind Server-Side Request Forgery (SSRF) via the Azure instance identity endpoint (`POST /api/v2/workspaceagents/azure-instance-identity`). An external attacker can force the Coder server to issue HTTP GET requests to arbitrary internal or external hosts by submitting a crafted PKCS#7 signature. The server does not return the target's response body, but error messages in the API response reveal whether the target is reachable and what type of failure occurred. Versions 2.24.5, 2.29.13, 2.30.8, 2.31.12, 2.32.2, and 2.33.3 patch the issue. As a workaround, if the Azure identity-auth mechanism is not being used then restrict access to the corresponding endpoint (`/api/v2/workspaceagents/azure-instance-identity`) using ingress firewall and/or proxy ACLs.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Coder ≫ Coder SwPlatformgo Version < 2.24.5
Coder ≫ Coder SwPlatformgo Version >= 2.29.0 < 2.29.13
Coder ≫ Coder SwPlatformgo Version >= 2.30.0 < 2.30.8
Coder ≫ Coder SwPlatformgo Version >= 2.31.0 < 2.31.12
Coder ≫ Coder SwPlatformgo Version >= 2.32.0 < 2.32.2
Coder ≫ Coder SwPlatformgo Version >= 2.33.0 < 2.33.3
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.34% 0.255
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
security-advisories@github.com 6.5 3.9 2.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CWE-918 Server-Side Request Forgery (SSRF)

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

https://github.com/coder/coder/security/advisories/GHSA-686c-7vgv-v3fx
Patch
Vendor Advisory
https://github.com/coder/coder/pull/25274
Patch
Issue Tracking
https://github.com/coder/coder/commit/57b11d405f17492aa789d4b9ff33366f961a37f8
Patch
https://github.com/coder/coder/releases/tag/v2.24.5
Release Notes
https://github.com/coder/coder/releases/tag/v2.29.13
Release Notes
https://github.com/coder/coder/releases/tag/v2.30.8
Release Notes
https://github.com/coder/coder/releases/tag/v2.31.12
Release Notes
https://github.com/coder/coder/releases/tag/v2.32.2
Release Notes
https://github.com/coder/coder/releases/tag/v2.33.3
Release Notes