What is the CVSS score of CVE-2026-46354?

CVE-2026-46354 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Coder are affected by CVE-2026-46354?

Coder v2 self-hosted instances face unauthenticated token theft risk, exposing Git SSH keys, OAuth credentials, and workspace secrets.. A patch is available.

How to fix or mitigate CVE-2026-46354?

Within 24 hours: Identify all Coder v2 instances and assess integration with Git systems (GitHub/GitLab/Bitbucket) and OAuth providers; isolate critical instances if necessary. Within 7 days: Apply vendor-released patch to all Coder v2 instances. Within 30 days: Audit workspace agent token usage logs for anomalies and proactively rotate all Git SSH keys and OAuth tokens.

Coder CVE-2026-46354

CRITICAL

Improper Verification of Cryptographic Signature (CWE-347)

2026-05-19 https://github.com/coder/coder

GHSA-6x44-w3xg-hqqf

Microsoft Jwt Attack Hashicorp RCE Gitlab

9.1

CVSS 3.1 · Vendor: https://github.com/coder/coder

Severity by source

Vendor (https://github.com/coder/coder) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Primary rating from Vendor (https://github.com/coder/coder) · only source for this CVE.

CVSS VectorVendor: https://github.com/coder/coder

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

May 19, 2026 - 20:30 vuln.today

Analysis Generated

May 19, 2026 - 20:30 vuln.today

DescriptionCVE.org

Summary

azureidentity.Validate() verifies that the PKCS#7 signer certificate chains to a trusted Azure CA but never verifies the PKCS#7 signature itself. An attacker can embed a legitimate Azure certificate alongside arbitrary content e.g. {"vmId":"<target>"} and the forged vmId will be accepted returning the victim workspace agent's session token.

No authentication is required. The attacker only needs to know a target VM's vmId which is a UUIDv4. > that's a practical limitation which would typically require prior access to be exploited

Root Cause

In unpatched Coder releases the signature over the PKCS#7 content is not validated - only the signing certificate is checked.

Impact

An attacker on any Azure VM or with access to a publicly available Azure IMDS certificate from CT logs can:

Steal an agent session token by sending a forged PKCS#7 envelope to POST /api/v2/workspaceagents/azure-instance-identity which is unauthenticated.
With the stolen token access:

Git SSH private key via GET /workspaceagents/me/gitsshkey: push to repositories and impersonate the workspace owner.
OAuth access tokens via GET /workspaceagents/me/external-auth: GitHub, GitLab, and Bitbucket tokens in plaintext.
Workspace secrets via the agent manifest: environment variables, file paths, and API keys.

Attack Path Diagram

Affected Versions

All versions of Coder v2 are affected.

Patches

Fixed in #25286

The fix was backported to all supported release lines:

Patched Versions
v2.33.3
v2.32.2
v2.31.12
v2.30.8
v2.29.13
v2.24.5

Workarounds

If unable to patch we recommend immediately reconfiguring any Azure templates to use token authentication rather than azure-instance-identity until the patch is released and you are fully upgraded.

Modify the coder_agent.auth value to be token.
Add CODER_AGENT_TOKEN=${coder_agent.main.token} to the set of environment variables for the Coder Workspace Agent initialization script.

Recognition

We'd like to thank Ben Tran of calif.io and Anthropic’s Security Team (ANT-2026-22445) for independently disclosing this issue!

AnalysisAI

Unauthenticated agent token theft in Coder v2 (self-hosted developer workspace platform) stems from azureidentity.Validate() verifying the PKCS#7 signer's certificate chain but skipping signature verification of the signed content itself. Remote attackers who know a target VM's vmId (a UUIDv4) can forge a PKCS#7 envelope containing a legitimate Azure certificate alongside attacker-controlled content and POST it to the unauthenticated /api/v2/workspaceagents/azure-instance-identity endpoint to receive the victim workspace agent's session token, which then unlocks Git SSH keys, OAuth tokens for GitHub/GitLab/Bitbucket, and workspace secrets. No public exploit identified at time of analysis, but the vulnerability is vendor-confirmed via GHSA-6x44-w3xg-hqqf and a detailed root-cause analysis with attack-path diagram is published.

Technical ContextAI

Coder is an open-source self-hosted cloud development environment (pkg:go/github.com/coder/coder/v2) where workspace agents authenticate to the control plane. For Azure-hosted workspaces, agents present a PKCS#7-signed attestation from Azure Instance Metadata Service (IMDS) to bootstrap their session token. The flaw is a classic CWE-347 (Improper Verification of Cryptographic Signature): the original implementation called signer.Verify() on the certificate chain only, never validating that the PKCS#7 SignedData content was actually signed by the private key corresponding to the embedded certificate. The patch replaces go.mozilla.org/pkcs7 with github.com/smallstep/pkcs7 and uses VerifyWithChainAtTime, which performs both the cryptographic signature check over the content and the chain-of-trust check in a single call. Because any Azure IMDS certificate is reachable (it can be harvested from any Azure VM or pulled from Certificate Transparency logs), the cryptographic trust anchor effectively collapsed to attacker-controllable input.

RemediationAI

Vendor-released patches: upgrade to v2.33.3, v2.32.2, v2.31.12, v2.30.8, v2.29.13, or v2.24.5 depending on your release line (release notes linked from https://github.com/coder/coder/security/advisories/GHSA-6x44-w3xg-hqqf; underlying fix in PR https://github.com/coder/coder/pull/25286). If immediate upgrade is not possible, the vendor-recommended workaround is to reconfigure Azure templates away from Azure Instance Identity to token authentication by setting coder_agent.auth = "token" in the Terraform resource and injecting CODER_AGENT_TOKEN=${coder_agent.main.token} into the agent initialization script's environment; the side effect is that each agent now requires the control plane to provision and distribute a long-lived token, removing the automatic Azure-attested bootstrap and shifting token-rotation responsibility to operators. After upgrading, rotate any agent tokens, Git SSH keys, and OAuth tokens that may have been exposed prior to patching, since past exploitation would not leave obvious traces on the unauthenticated endpoint.