Skip to content
Fencer Vulns
critical 9.1

CVE-2026-46354 json

Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft

published 2026-05-19 5 mo ago modified 2026-07-08 4 mo ago also GHSA-6x44-w3xg-hqqf , GO-2026-5196 , EUVD-2026-42111

cvss
9.1
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 24%
public exploits
0
none known

Summary

Coder allows organizations to provision remote development environments via Terraform. In versions prior tp 2.24.5, 2.29.13, 2.30.8, 2.31.12, 2.32.2, and 2.33.3, `azureidentity.Validate()` verifies that the PKCS#7 signer certificate chains to a trusted Azure CA but never verifies the PKCS#7 signature itself. An attacker can embed a legitimate Azure certificate alongside arbitrary content e.g. `{"vmId":"<target>"}` and the forged `vmId` will be accepted returning the victim workspace agent's session token. No authentication is required. The attacker only needs to know a target VM's `vmId` which is a `UUIDv4`. That's a practical limitation which would typically require prior access to be exploited. Versions 2.24.5, 2.29.13, 2.30.8, 2.31.12, 2.32.2, and 2.33.3 patch the issue. As a workaround, reconfigure any Azure templates to use token authentication rather than `azure-instance-identity`.

Patch / fix

  • go github.com/coder/coder/v2 2.24.5, 2.29.13, 2.30.8, 2.31.12, 2.32.2, 2.33.3
  • coder coder 2.24.5, 2.29.13, 2.30.8, 2.31.12, 2.32.2, 2.33.3
  • govulncheck-vulndb openSUSE Leap 16.0 0.0.20260723T184607-160000.1.1

opensuse advisories openSUSE-SU-2026:21483-1

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
total
Assessed
4 mo ago

Exploit prediction

0.32% chance of exploitation in the next 30 days, higher than 24% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
GitHub 3.1 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected packages

ecosystem package affected fixed in
go github.com/coder/coder/v2
>=2.33.0-rc.0, <2.33.3
>=2.32.0-rc.0, <2.32.2
>=2.31.0, <2.31.12
>=2.30.0, <2.30.8
>=2.29.0, <2.29.13
<2.24.5
2.33.3
2.32.2
2.31.12
2.30.8
2.29.13
2.24.5
go github.com/coder/coder
<=0.27.3
all versions
 no fix listed

Affected products

  • coder coder

Classification

Weakness
  • CWE-347 Improper Verification of Cryptographic Signature

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.