CVE-2026-46354 — Coder: PKCS#7 signature bypass in...

CRITICAL

Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft

Published May 19, 2026Updated June 25, 2026Source: osv

Summary

## Summary `azureidentity.Validate()` verifies that the PKCS#7 signer certificate chains to a trusted Azure CA but never verifies the PKCS#7 signature itself. An attacker can embed a legitimate Azure certificate alongside arbitrary content e.g. `{"vmId":"<target>"}` and the forged `vmId` will be accepted returning the victim workspace agent's session token. **No authentication is required.** The attacker only needs to know a target VM's `vmId` which is a `UUIDv4`. > that's a practical limitation which would typically require prior access to be exploited ## Root Cause In unpatched Coder releases the signature over the PKCS#7 content is not validated - only the signing certificate is checked. ## Impact An attacker on any Azure VM or with access to a publicly available Azure IMDS certificate from CT logs can: 1. **Steal an agent session token** by sending a forged PKCS#7 envelope to `POST /api/v2/workspaceagents/azure-instance-identity` which is unauthenticated. 2. **With the stolen token** access: - **Git SSH private key** via `GET /workspaceagents/me/gitsshkey`: push to repositories and impersonate the workspace owner. - **OAuth access tokens** via `GET /workspaceagents/me/external-auth`: GitHub, GitLab, and Bitbucket tokens in plaintext. - **Workspace secrets** via the agent manifest: environment variables, file paths, and API keys. ## Attack Path Diagram <img width="5588" height="4176" alt="PKCS7_diagram (1)" src="https://github.com/user-attachments/assets/74e88a89-a995-450d-87ab-6feed03579a5" /> ## Affected Versions All versions of Coder v2 are affected. ## Patches Fixed in [#25286 ](https://github.com/coder/coder/pull/25286) The fix was backported to all supported release lines: | Patched Versions | | --- | | [**v2.33.3**](https://github.com/coder/coder/releases/tag/v2.33.3) | | [**v2.32.2**](https://github.com/coder/coder/releases/tag/v2.32.2) | | [**v2.31.12**](https://github.com/coder/coder/releases/tag/v2.31.12) | | [**v2.30.8**](https://github.com/coder/coder/releases/tag/v2.30.8) | | [**v2.29.13**](https://github.com/coder/coder/releases/tag/v2.29.13) | | [**v2.24.5**](https://github.com/coder/coder/releases/tag/v2.24.5) | ## Workarounds If unable to patch we recommend immediately reconfiguring any Azure templates to use token authentication rather than `azure-instance-identity` until the patch is released and you are fully upgraded. 1. Modify the [`coder_agent.auth`](https://registry.terraform.io/providers/coder/coder/latest/docs/resources/agent#auth-1) value to be `token`. 2. Add `CODER_AGENT_TOKEN=${coder_agent.main.token}` to the set of environment variables for the Coder Workspace Agent initialization script. ## Recognition We'd like to thank [Ben Tran](https://github.com/bencalif) of [calif.io](http://calif.io) and Anthropic’s Security Team (`ANT-2026-22445`) for independently disclosing this issue!

Advisory Timeline

First published May 19, 2026 (146 days ago).
Last revised June 25, 2026 — 37 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

Update github.com/coder/coder/v2 to 2.32.2 or later

go get github.com/coder/coder/v2@v2.32.2

Update github.com/coder/coder/v2 to 2.31.12 or later

go get github.com/coder/coder/v2@v2.31.12

Update github.com/coder/coder/v2 to 2.33.3 or later

go get github.com/coder/coder/v2@v2.33.3

Update github.com/coder/coder/v2 to 2.30.8 or later

go get github.com/coder/coder/v2@v2.30.8

Update github.com/coder/coder/v2 to 2.29.13 or later

go get github.com/coder/coder/v2@v2.29.13

Update github.com/coder/coder/v2 to 2.24.5 or later

go get github.com/coder/coder/v2@v2.24.5

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (7)

Affects 1 ecosystem: go (2).

Package	Ecosystem	Affected	Fixed In
github.com/coder/coder/v2	go	All versions	2.32.2
github.com/coder/coder/v2	go	All versions	2.31.12
github.com/coder/coder/v2	go	All versions	2.33.3
github.com/coder/coder/v2	go	All versions	2.30.8
github.com/coder/coder/v2	go	All versions	2.29.13
github.com/coder/coder/v2	go	All versions	2.24.5
github.com/coder/coder	go	All versions	Range-based data available

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CWE-347
Improper Verification of Cryptographic SignatureMITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 9.1 score means for each attack dimension.

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

References

Frequently Asked Questions

What is CVE-2026-46354?: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft This vulnerability has been assigned a severity rating of CRITICAL (CVSS score: 9.1/10).
How do I check if my project is affected by CVE-2026-46354?: CVE-2026-46354 affects github.com/coder/coder/v2 and github.com/coder/coder. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2026-46354 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score

9.1

Exploitation is straightforward and causes maximum impact. Patch immediately.

Also Known As

GHSA-6x44-w3xg-hqqf

GO-2026-5196

Related CVEs

CVE-2026-107806
CRITICAL
Nginx UI: Authenticated Remote Code Execution via Backup Restore App Config Overwrite
CVE-2026-68582
CRITICAL
Vikunja: Link-share token reads any tenant's kanban buckets and enumerates usernames/IDs instance-wide (BOLA)
CVE-2026-55429
HIGH
Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID
CVE-2026-44454
HIGH
Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent
CVE-2026-55427
HIGH
Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh`
CVE-2026-63443
HIGH
Coder's workspace agent API insecure redirect handling allowed cross-agent file read and write
CVE-2026-55431
HIGH
Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps
CVE-2026-55428
HIGH
Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies