Coder CVE-2026-46354

Target Coder v2 deployment must be running an unpatched version AND have workspaces configured with coder_agent.auth = "azure-instance-identity" - deployments using token authentication for agents do not expose the vulnerable POST /api/v2/workspaceagents/azure-instance-identity code path. The attacker must reach the Coder control plane over the network (AV:N) but needs no credentials or user interaction. The only practical prerequisite the vendor itself flags as a limiter is knowledge of the target workspace's vmId, a UUIDv4 that is not directly enumerable and typically requires reconnaissance or prior access to the Azure environment to discover. The attacker also needs any legitimate Azure IMDS leaf certificate, which is trivially obtainable from any Azure VM or from public Certificate Transparency logs.

CVSS 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) aligns with the technical reality: network-reachable, unauthenticated, low complexity, high confidentiality and integrity impact (agent token grants access to SSH keys, OAuth tokens, secrets), and no availability impact. EPSS and KEV data were not provided in the input, so neither active-exploitation nor predicted-exploitation probability can be cited. The practical limiter is knowledge of a target vmId (a UUIDv4) - the vendor itself notes this typically requires prior access or reconnaissance, which tempers the otherwise pure AC:L rating. No public exploit identified at time of analysis, but the advisory documents the bypass technique in enough detail (forge PKCS#7 envelope with valid Azure cert + arbitrary content) that weaponization is straightforward for a motivated attacker. This is a real priority for any Coder deployment that uses azure-instance-identity authentication; deployments using token-based agent auth are not exposed by this specific flaw.

An attacker spins up a throwaway Azure VM (or pulls any Azure IMDS leaf certificate from Certificate Transparency logs) and identifies a target Coder workspace's vmId through reconnaissance or prior low-privilege access. They craft a PKCS#7 envelope containing the legitimate Azure certificate plus a forged JSON payload {"vmId":"<target-uuid>"} without a valid signature over that content, then POST it to the unauthenticated /api/v2/workspaceagents/azure-instance-identity endpoint and receive the victim agent's session token, which they use to GET /workspaceagents/me/gitsshkey and /workspaceagents/me/external-auth to exfiltrate Git SSH private keys and plaintext GitHub/GitLab/Bitbucket OAuth tokens.