Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
NVD Vulnerability Details :
CVE-2026-45796
Analyzed
More InfoOfficial Page
Source-security-advisories@github.com
View Known Exploited Vulnerability (KEV) details
Published At-07 Jul, 2026 | 22:16
Updated At-08 Jul, 2026 | 19:47

Coder allows organizations to provision remote development environments via Terraform. Versions prior tp 2.24.5, 2.29.13, 2.30.8, 2.31.12, 2.32.2, and 2.33.3 are vulnerable to unauthenticated semi-blind Server-Side Request Forgery (SSRF) via the Azure instance identity endpoint (`POST /api/v2/workspaceagents/azure-instance-identity`). An external attacker can force the Coder server to issue HTTP GET requests to arbitrary internal or external hosts by submitting a crafted PKCS#7 signature. The server does not return the target's response body, but error messages in the API response reveal whether the target is reachable and what type of failure occurred. Versions 2.24.5, 2.29.13, 2.30.8, 2.31.12, 2.32.2, and 2.33.3 patch the issue. As a workaround, if the Azure identity-auth mechanism is not being used then restrict access to the corresponding endpoint (`/api/v2/workspaceagents/azure-instance-identity`) using ingress firewall and/or proxy ACLs.

CISA Catalog
Date AddedDue DateVulnerability NameRequired Action
N/A
Date Added: N/A
Due Date: N/A
Vulnerability Name: N/A
Required Action: N/A
Metrics
TypeVersionBase scoreBase severityVector
Secondary3.16.5MEDIUM
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
N/A
Type: Secondary
Version: 3.1
Base score: 6.5
Base severity: MEDIUM
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Type: N/A
Version:
Base score:
Base severity: N/A
Vector:
CPE Matches

coder
coder
>>coder>>Versions before 2.24.5(exclusive)
cpe:2.3:a:coder:coder:*:*:*:*:*:go:*:*
coder
coder
>>coder>>Versions from 2.29.0(inclusive) to 2.29.13(exclusive)
cpe:2.3:a:coder:coder:*:*:*:*:*:go:*:*
coder
coder
>>coder>>Versions from 2.30.0(inclusive) to 2.30.8(exclusive)
cpe:2.3:a:coder:coder:*:*:*:*:*:go:*:*
coder
coder
>>coder>>Versions from 2.31.0(inclusive) to 2.31.12(exclusive)
cpe:2.3:a:coder:coder:*:*:*:*:*:go:*:*
coder
coder
>>coder>>Versions from 2.32.0(inclusive) to 2.32.2(exclusive)
cpe:2.3:a:coder:coder:*:*:*:*:*:go:*:*
coder
coder
>>coder>>Versions from 2.33.0(inclusive) to 2.33.3(exclusive)
cpe:2.3:a:coder:coder:*:*:*:*:*:go:*:*
Weaknesses
CWE IDTypeSource
CWE-918Secondarysecurity-advisories@github.com
CWE ID: CWE-918
Type: Secondary
Source: security-advisories@github.com
Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References
HyperlinkSourceResource
https://github.com/coder/coder/commit/57b11d405f17492aa789d4b9ff33366f961a37f8security-advisories@github.com
Patch
https://github.com/coder/coder/pull/25274security-advisories@github.com
Issue Tracking
Patch
https://github.com/coder/coder/releases/tag/v2.24.5security-advisories@github.com
Release Notes
https://github.com/coder/coder/releases/tag/v2.29.13security-advisories@github.com
Release Notes
https://github.com/coder/coder/releases/tag/v2.30.8security-advisories@github.com
Release Notes
https://github.com/coder/coder/releases/tag/v2.31.12security-advisories@github.com
Release Notes
https://github.com/coder/coder/releases/tag/v2.32.2security-advisories@github.com
Release Notes
https://github.com/coder/coder/releases/tag/v2.33.3security-advisories@github.com
Release Notes
https://github.com/coder/coder/security/advisories/GHSA-686c-7vgv-v3fxsecurity-advisories@github.com
Patch
Vendor Advisory
Hyperlink: https://github.com/coder/coder/commit/57b11d405f17492aa789d4b9ff33366f961a37f8
Source: security-advisories@github.com
Resource:
Patch
Hyperlink: https://github.com/coder/coder/pull/25274
Source: security-advisories@github.com
Resource:
Issue Tracking
Patch
Hyperlink: https://github.com/coder/coder/releases/tag/v2.24.5
Source: security-advisories@github.com
Resource:
Release Notes
Hyperlink: https://github.com/coder/coder/releases/tag/v2.29.13
Source: security-advisories@github.com
Resource:
Release Notes
Hyperlink: https://github.com/coder/coder/releases/tag/v2.30.8
Source: security-advisories@github.com
Resource:
Release Notes
Hyperlink: https://github.com/coder/coder/releases/tag/v2.31.12
Source: security-advisories@github.com
Resource:
Release Notes
Hyperlink: https://github.com/coder/coder/releases/tag/v2.32.2
Source: security-advisories@github.com
Resource:
Release Notes
Hyperlink: https://github.com/coder/coder/releases/tag/v2.33.3
Source: security-advisories@github.com
Resource:
Release Notes
Hyperlink: https://github.com/coder/coder/security/advisories/GHSA-686c-7vgv-v3fx
Source: security-advisories@github.com
Resource:
Patch
Vendor Advisory
Change History
0Changes found

Details not found