Junglewise Threat Intelligence

CVE-2026-45796: Coder SSRF in Azure instance identity endpoint

CVE-2026-45796 · Severity: medium · CVSS 6.5 · Published 2026-07-07

Technologies: Coder. Vendors: Go, Coder.

Executive brief

Coder, a platform for managing remote development environments, is vulnerable to a security flaw in its Azure identity authentication component. An unauthenticated attacker can trick the Coder server into making unauthorized network requests to internal or external systems. While the attacker cannot see the full response from these systems, they can use error messages to map out internal network infrastructure or verify the existence of internal services, potentially leading to further network compromise.

Technical details

A semi-blind Server-Side Request Forgery (SSRF) vulnerability exists in Coder's Azure instance identity endpoint (`POST /api/v2/workspaceagents/azure-instance-identity`). The root cause is insufficient validation of the `IssuingCertificateURL` within a submitted PKCS#7 signature. An unauthenticated remote attacker can provide a crafted signature to force the Coder server to perform HTTP GET requests to arbitrary internal or external IP addresses or hostnames. While the response body is not returned to the attacker, the API returns specific error messages that allow the attacker to determine if a host is reachable and identify the type of connection failure. The fix implements a host/port allowlist (restricting to Microsoft and DigiCert), prevents DNS rebinding by resolving hosts once, and rejects requests to loopback or private (RFC 1918) IP ranges.

Affected products

  • Coder Coder < 2.24.5, >= 2.29.0 < 2.29.13, >= 2.30.0 < 2.30.8, >= 2.31.0 < 2.31.12, >= 2.32.0-rc.0 < 2.32.2, >= 2.33.0-rc.0 < 2.33.3

Timeline

  • 2026-05-13: patched: Fixes merged into main and released in various versions.
  • 2026-07-07: advisory: CVE-2026-45796 published.

References

Related threats