CVE-2026-45796 Details
Description
Coder allows organizations to provision remote development environments via Terraform. Versions prior tp 2.24.5, 2.29.13, 2.30.8, 2.31.12, 2.32.2, and 2.33.3 are vulnerable to unauthenticated semi-blind Server-Side Request Forgery (SSRF) via the Azure instance identity endpoint (`POST /api/v2/workspaceagents/azure-instance-identity`). An external attacker can force the Coder server to issue HTTP GET requests to arbitrary internal or external hosts by submitting a crafted PKCS#7 signature. The server does not return the target's response body, but error messages in the API response reveal whether the target is reachable and what type of failure occurred. Versions 2.24.5, 2.29.13, 2.30.8, 2.31.12, 2.32.2, and 2.33.3 patch the issue. As a workaround, if the Azure identity-auth mechanism is not being used then restrict access to the corresponding endpoint (`/api/v2/workspaceagents/azure-instance-identity`) using ingress firewall and/or proxy ACLs.
A vulnerability allowing unauthenticated semi-blind server-side request forgery (SSRF) has been identified in Coder versions prior to 2.24.5, 2.29.13, 2.30.8, 2.31.12, 2.32.2, and 2.33.3. This vulnerability occurs through the Azure instance identity endpoint when the server is tricked into sending HTTP GET requests to arbitrary internal or external hosts. Exploitation involves submitting a crafted PKCS#7 signature, which the server processes without proper validation, allowing an attacker to infer the reachability of targets based on the API's error responses.
Update Coder to version 2.24.5, 2.29.13, 2.30.8, 2.31.12, 2.32.2, or 2.33.3. If the Azure identity-auth mechanism is not being used, restrict access to the `/api/v2/workspaceagents/azure-instance-identity` endpoint using ingress firewall or proxy ACLs.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| coder coder | < 2.24.5 >= 2.29.0, < 2.29.13 >= 2.30.0, < 2.30.8 >= 2.31.0, < 2.31.12 >= 2.32.0, < 2.32.2 >= 2.33.0, < 2.33.3 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 8, 2026 | Initial Analysis | [email protected] |
| Jul 8, 2026 | CVE Modified | CISA-ADP |
| Jul 7, 2026 | New CVE Received | [email protected] |