Vulnerability · Published Jul 7, 2026 · Assigned by GitHub_M

CVE-2026-45796Coder vulnerable to unauthenticated SSRF via Azure Instance Identity Endpoint

Medium 6.5

In plain English

A medium-severity server-side request forgery in coder from coder. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 37% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.4%top 62.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Coder allows organizations to provision remote development environments via Terraform. Versions prior tp 2.24.5, 2.29.13, 2.30.8, 2.31.12, 2.32.2, and 2.33.3 are vulnerable to unauthenticated semi-blind Server-Side Request Forgery (SSRF) via the Azure instance identity endpoint (`POST /api/v2/workspaceagents/azure-instance-identity`). An external attacker can force the Coder server to issue HTTP GET requests to arbitrary internal or external hosts by submitting a crafted PKCS#7 signature. The server does not return the target's response body, but error messages in the API response reveal whether the target is reachable and what type of failure occurred. Versions 2.24.5, 2.29.13, 2.30.8, 2.31.12, 2.32.2, and 2.33.3 patch the issue. As a workaround, if the Azure identity-auth mechanism is not being used then restrict access to the corresponding endpoint (`/api/v2/workspaceagents/azure-instance-identity`) using ingress firewall and/or proxy ACLs.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Go	github.com/coder/coder	no fix listed	GO-2026-5169
Go	github.com/coder/coder	no fix listed	GHSA-686c-7vgv-v3fx
Go	github.com/coder/coder/v2	2.31.12	GHSA-686c-7vgv-v3fx
Go	github.com/coder/coder/v2	2.30.8	GHSA-686c-7vgv-v3fx
Go	github.com/coder/coder/v2	2.29.13	GHSA-686c-7vgv-v3fx
Go	github.com/coder/coder/v2	2.24.5	GHSA-686c-7vgv-v3fx
Go	github.com/coder/coder/v2	2.33.3	GHSA-686c-7vgv-v3fx
Go	github.com/coder/coder/v2	2.24.5, 2.29.13, 2.30.8, 2.31.12, 2.32.2, 2.33.3	GO-2026-5169
Go	github.com/coder/coder/v2	2.32.2	GHSA-686c-7vgv-v3fx

Affected products (as reported)

Vendor	Product	Versions
coder	coder	>= 2.33.0-rc.0, < 2.33.3>= 2.32.0-rc.0, < 2.32.2>= 2.31.0, < 2.31.12>= 2.30.0, < 2.30.8>= 2.29.0, < 2.29.13< 2.24.5

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

References

https://github.com/coder/coder/security/advisories/GHSA-686c-7vgv-v3fx x_refsource_CONFIRM
https://github.com/coder/coder/pull/25274 x_refsource_MISC
https://github.com/coder/coder/commit/57b11d405f17492aa789d4b9ff33366f961a37f8 x_refsource_MISC
https://github.com/coder/coder/releases/tag/v2.24.5 x_refsource_MISC
https://github.com/coder/coder/releases/tag/v2.29.13 x_refsource_MISC
https://github.com/coder/coder/releases/tag/v2.30.8 x_refsource_MISC
https://github.com/coder/coder/releases/tag/v2.31.12 x_refsource_MISC
https://github.com/coder/coder/releases/tag/v2.32.2 x_refsource_MISC
https://github.com/coder/coder/releases/tag/v2.33.3 x_refsource_MISC