Junglewise Threat Intelligence

CVE-2026-46354: Coder signature verification bypass in Azure instance identity validation

CVE-2026-46354 · Severity: critical · CVSS 9.1 · Published 2026-07-07

Technologies: github.com/coder/coder/v2 (Go), Coder, github.com/coder/coder (Go). Vendors: Go, Coder.

Executive brief

Coder, a platform for managing remote development environments, contains a security flaw in how it verifies Azure identities. An attacker can bypass security checks to impersonate a legitimate development workspace and obtain its session token. This could allow an unauthorized user to gain access to sensitive development environments and the data within them. Organizations using Azure-based templates are advised to update to a patched version or switch to token-based authentication.

Technical details

A vulnerability exists in Coder's `azureidentity.Validate()` function where it verifies that a PKCS#7 signer certificate chains to a trusted Azure CA but fails to verify the actual PKCS#7 signature. This allows a remote, unauthenticated attacker to provide a legitimate Azure certificate alongside a forged payload (such as a specific `vmId`). If the attacker knows the target's UUIDv4 `vmId`, they can successfully authenticate as that workspace and receive its session token. The issue is resolved by migrating to a library that correctly validates both the certificate chain and the signature. Patches are available in versions 2.24.5, 2.29.13, 2.30.8, 2.31.12, 2.32.2, and 2.33.3.

Affected products

  • Coder Coder < 2.24.5, >= 2.29.0 < 2.29.13, >= 2.30.0 < 2.30.8, >= 2.31.0 < 2.31.12, >= 2.32.0 < 2.32.2, >= 2.33.0 < 2.33.3

Timeline

  • 2026-05-13: patched: Fix merged and releases published
  • 2026-07-07: disclosed: CVE published to NVD

References

Related threats