Medium 6.5Published Jul 7, 2026

CVE-2026-45796Coder allows organizations to provision remote development environments via Terraform.

Updated under an hour ago (2026-10-19 06:50 UTC)

Does this affect you?

It affects coder. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for coder

Exploited in the last 30 days

Coder allows organizations to provision remote development environments via Terraform. Versions prior tp 2.24.5, 2.29.13, 2.30.8, 2.31.12, 2.32.2, and 2.33.3 are vulnerable to unauthenticated semi-blind Server-Side Request Forgery (SSRF) via the Azure instance identity endpoint (`POST /api/v2/workspaceagents/azure-instance-identity`). An external attacker can force the Coder server to issue HTTP GET requests to arbitrary internal or external hosts by submitting a crafted PKCS#7 signature. The server does not return the target's response body, but error messages in the API response reveal whether the target is reachable and what type of failure occurred. Versions 2.24.5, 2.29.13, 2.30.8, 2.31.12, 2.32.2, and 2.33.3 patch the issue. As a workaround, if the Azure identity-auth mechanism is not being used then restrict access to the corresponding endpoint (`/api/v2/workspaceagents/azure-instance-identity`) using ingress firewall and/or proxy ACLs.

CVSS: 6.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Weakness (CWE): CWE-918
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Not given
NVD analysis: Analyzed
Record last updated: Jul 8, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

coder coder coder:coder	before 2.24.5; from 2.29.0 before 2.29.13; from 2.30.0 before 2.30.8; from 2.31.0 before 2.31.12; from 2.32.0 before 2.32.2; from 2.33.0 before 2.33.3	NVD

References

https://github.com/coder/coder/commit/57b11d405f17492aa789d4b9ff33366f961a37f8patch
https://github.com/coder/coder/pull/25274issue-tracking, patch
https://github.com/coder/coder/releases/tag/v2.24.5release-notes
https://github.com/coder/coder/releases/tag/v2.29.13release-notes
https://github.com/coder/coder/releases/tag/v2.30.8release-notes
https://github.com/coder/coder/releases/tag/v2.31.12release-notes
https://github.com/coder/coder/releases/tag/v2.32.2release-notes
https://github.com/coder/coder/releases/tag/v2.33.3release-notes
https://github.com/coder/coder/security/advisories/GHSA-686c-7vgv-v3fxpatch, vendor-advisory

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.