Junglewise Threat Intelligence

CVE-2026-55427: Coder SSH configuration injection in coder config-ssh

CVE-2026-55427 · Severity: high · CVSS 8.3 · Published 2026-07-08

Technologies: Coder. Vendors: Go, Coder.

Executive brief

Coder is a platform used by organizations to manage and deploy remote development environments. A security vulnerability in the Coder command-line tool could allow a compromised or malicious server to inject unauthorized settings into a developer's local SSH configuration file. If exploited, this could allow an attacker to intercept connections, redirect traffic, or gain unauthorized access to the developer's machine or other sensitive systems.

Technical details

A configuration injection vulnerability exists in the Coder CLI's 'coder config-ssh' command. The tool writes server-supplied SSH settings, specifically 'HostnameSuffix' and 'SSHConfigOptions', directly into the user's local '~/.ssh/config' file without sanitizing newlines or restricting directives. An attacker who controls a Coder deployment, performs a man-in-the-middle attack, or has administrative access to these settings can inject arbitrary SSH directives. This can lead to unauthorized command execution or credential exfiltration via SSH configuration features. The issue is resolved in versions 2.29.17, 2.32.7, 2.33.8, and 2.34.2 by implementing strict character validation that rejects newlines and control characters.

Affected products

  • Coder Coder < 2.29.17, >= 2.30.0 < 2.32.7, >= 2.33.0 < 2.33.8, >= 2.34.0 < 2.34.2

Timeline

  • 2026-06-09: other: Fix pull request submitted
  • 2026-06-11: patched: Security releases published for 2.32.x, 2.33.x, and 2.34.x
  • 2026-06-12: patched: Security release published for 2.29.x
  • 2026-07-08: disclosed: CVE published to NVD

References

Related threats