CVE-2026-45796: Coder SSRF in Azure instance identity endpoint

CVE-2026-45796 · Severity: medium · CVSS 6.5 · Published 2026-07-07

Coder, a platform for managing remote development environments, is vulnerable to a security flaw in its Azure identity authentication component. An unauthenticated attacker can trick the Coder server into making unauthorized network requests to internal or external systems. While the attacker cannot see the full response from these systems, they can use error messages to map out internal network infrastructure or verify the existence of internal services, potentially leading to further network compromise.

Technologies: Coder, github.com/coder/coder (Go), github.com/coder/coder/v2 (Go). Vendors: Coder, Go.

Quick answers

Is CVE-2026-45796 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-45796 being exploited in the wild.
How severe is CVE-2026-45796?
Medium severity, with a CVSS score of 6.5, published 7 July 2026.
Which products and versions are affected?
Coder < 2.24.5, >= 2.29.0 < 2.29.13, >= 2.30.0 < 2.30.8, >= 2.31.0 < 2.31.12, >= 2.32.0 < 2.32.2, >= 2.33.0 < 2.33.3, < 2.24.5, >= 2.29.0 < 2.29.13, >= 2.30.0 < 2.30.8, >= 2.31.0 < 2.31.12, >= 2.32.0-rc.0 < 2.32.2, >= 2.33.0-rc.0 < 2.33.3; github.com/coder/coder (Go) SEMVER:introduced=0, SEMVER:introduced=0,last_affected=0.27.3; github.com/coder/coder/v2 (Go) SEMVER:introduced=0,fixed=2.24.5,introduced=2.29.0,fixed=2.29.13,introduced=2.30.0,fixed=2.30.8,introduced=2.31.0,fixed=2.31.12,introduced=2.32.0-rc.0,fixed=2.32.2,introduced=2.33.0-rc.0,fixed=2.33.3, SEMVER:introduced=2.33.0-rc.0,fixed=2.33.3.
Is there a fix for CVE-2026-45796?
Yes. github.com/coder/coder/v2 (Go): upgrade to 2.33.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-45796 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-45796?
Check whether you run Coder, github.com/coder/coder (Go) or github.com/coder/coder/v2 (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/coder/coder/v2 (Go): upgrade to 2.33.3 or later
    go get github.com/coder/coder/v2@v2.33.3

Technical details

A semi-blind Server-Side Request Forgery (SSRF) vulnerability exists in Coder's Azure instance identity endpoint (`POST /api/v2/workspaceagents/azure-instance-identity`). The root cause is insufficient validation of the `IssuingCertificateURL` within a submitted PKCS#7 signature. An unauthenticated remote attacker can provide a crafted signature to force the Coder server to perform HTTP GET requests to arbitrary internal or external IP addresses or hostnames. While the response body is not returned to the attacker, the API returns specific error messages that allow the attacker to determine if a host is reachable and identify the type of connection failure. The fix implements a host/port allowlist (restricting to Microsoft and DigiCert), prevents DNS rebinding by resolving hosts once, and rejects requests to loopback or private (RFC 1918) IP ranges.

Affected products

  • Coder Coder < 2.24.5, >= 2.29.0 < 2.29.13, >= 2.30.0 < 2.30.8, >= 2.31.0 < 2.31.12, >= 2.32.0-rc.0 < 2.32.2, >= 2.33.0-rc.0 < 2.33.3

Identifiers

  • CVE-2026-45796
  • GHSA-686c-7vgv-v3fx
  • GO-2026-5169

Timeline

  • 2026-05-13: patched: Fixes merged into main and released in various versions.
  • 2026-07-07: advisory: CVE-2026-45796 published.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.