CVE-2026-46354 in Coder
Summary
by MITRE • 07/07/2026
Coder allows organizations to provision remote development environments via Terraform. In versions prior tp 2.24.5, 2.29.13, 2.30.8, 2.31.12, 2.32.2, and 2.33.3, `azureidentity.Validate()` verifies that the PKCS#7 signer certificate chains to a trusted Azure CA but never verifies the PKCS#7 signature itself. An attacker can embed a legitimate Azure certificate alongside arbitrary content e.g. `{"vmId":"<target>"}` and the forged `vmId` will be accepted returning the victim workspace agent's session token. No authentication is required. The attacker only needs to know a target VM's `vmId` which is a `UUIDv4`. That's a practical limitation which would typically require prior access to be exploited. Versions 2.24.5, 2.29.13, 2.30.8, 2.31.12, 2.32.2, and 2.33.3 patch the issue. As a workaround, reconfigure any Azure templates to use token authentication rather than `azure-instance-identity`.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/08/2026
The vulnerability in Coder affects remote development environment provisioning through Terraform integration and stems from insufficient validation of PKCS#7 signatures within the azureidentity.Validate() function. This flaw creates a critical security gap where attackers can exploit the certificate chain verification process without proper signature validation, allowing for unauthorized access to victim workspace agents. The issue specifically impacts versions prior to 2.24.5, 2.29.13, 2.30.8, 2.31.12, 2.32.2, and 2.33.3 where the system accepts forged certificates that chain to trusted Azure CAs but lack proper signature verification.
The technical implementation flaw involves the validation process failing to verify the PKCS#7 signature integrity, creating a path for attackers to craft malicious certificates containing legitimate Azure certificate chains alongside arbitrary payload data such as `{"vmId":"<target>"}`. This vulnerability operates under CWE-330 weakness category related to use of insecure randomness or improper validation of cryptographic signatures, and aligns with ATT&CK technique T1566.001 for credential access through valid accounts or tokens. The system accepts the forged vmId values because it only validates certificate chain authenticity rather than signature integrity, allowing attackers to impersonate legitimate VM instances.
The operational impact of this vulnerability is significant as it enables unauthorized access to workspace agent session tokens without requiring authentication credentials. Attackers need only knowledge of a target VM's UUIDv4 identifier which typically requires prior access or reconnaissance to obtain. This creates a privilege escalation vector where an attacker with network access and a valid vmId can gain access to session tokens belonging to victim workspace agents, potentially leading to complete system compromise. The vulnerability essentially allows for lateral movement and persistent access within environments using Coder's Azure integration.
Organizations affected by this vulnerability should immediately upgrade to patched versions 2.24.5, 2.29.13, 2.30.8, 2.31.12, 2.32.2, and 2.33.3 which implement proper PKCS#7 signature verification. As a temporary workaround, administrators should reconfigure Azure templates to utilize token authentication instead of azure-instance-identity authentication methods. This remediation approach eliminates the vulnerable certificate validation path while maintaining functional access control mechanisms. Security teams should also monitor for potential exploitation attempts and consider implementing network segmentation to limit lateral movement opportunities within environments containing vulnerable Coder deployments.