CVE-2026-45796: Coder SSRF Vulnerability

CVE-2026-45796 Overview

CVE-2026-45796 is an unauthenticated Server-Side Request Forgery (SSRF) vulnerability in Coder, an open-source platform that provisions remote development environments through Terraform. The flaw exists in the Azure instance identity endpoint (POST /api/v2/workspaceagents/azure-instance-identity) and allows external attackers to coerce the Coder server into issuing HTTP GET requests to arbitrary internal or external hosts. Exploitation requires submitting a crafted PKCS#7 signature. The vulnerability is classified under CWE-918: Server-Side Request Forgery.

Critical Impact
An unauthenticated remote attacker can probe internal network resources and infer their reachability and error states through the semi-blind SSRF, exposing otherwise inaccessible services behind the Coder server.

Affected Products

Coder versions prior to 2.24.5
Coder versions 2.29.x prior to 2.29.13, 2.30.x prior to 2.30.8, 2.31.x prior to 2.31.12
Coder versions 2.32.x prior to 2.32.2 and 2.33.x prior to 2.33.3

Discovery Timeline

2026-07-07 - CVE-2026-45796 published to NVD
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-45796

Vulnerability Analysis

The vulnerability resides in the Coder server's Azure identity authentication handler, which accepts a PKCS#7 signature via the /api/v2/workspaceagents/azure-instance-identity endpoint. During signature validation, the server fetches a certificate from a URL referenced by the submitted PKCS#7 blob. An attacker can craft a signature that points to an arbitrary target, causing the server to issue an outbound HTTP GET request on the attacker's behalf.

The SSRF is semi-blind. The server does not return the target's response body to the attacker. However, differentiated error messages disclose whether the target is reachable, whether it returned a TLS error, or whether the connection was refused. This side-channel allows attackers to enumerate internal hosts, map network topology, and identify live services behind the Coder deployment perimeter.

Root Cause

The root cause is insufficient validation of the certificate fetch URL derived from the untrusted PKCS#7 signature. The endpoint accepts unauthenticated requests, treating any submitted signature as potentially valid input for the Azure identity workflow. The patch in commit 57b11d405f17492aa789d4b9ff33366f961a37f8 hardens the Azure identity certificate fetch to restrict outbound requests.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker sends a crafted HTTP POST request containing a manipulated PKCS#7 signature to the vulnerable endpoint. The Coder server parses the signature, extracts the embedded certificate URL, and initiates an HTTP GET request to that address. By observing API error responses, the attacker infers the state of internal resources.

// Patch snippet from coderd/workspaceresourceauth.go
// fix(coderd): harden Azure identity certificate fetch (#25274)
 
 	"github.com/mitchellh/mapstructure"
 
+	"cdr.dev/slog/v3"
 	"github.com/coder/coder/v2/coderd/awsidentity"
 	"github.com/coder/coder/v2/coderd/azureidentity"
 	"github.com/coder/coder/v2/coderd/database/dbauthz"

Source: coder/coder commit 57b11d4

Detection Methods for CVE-2026-45796

Indicators of Compromise

Unauthenticated HTTP POST requests to /api/v2/workspaceagents/azure-instance-identity from external or unexpected source IPs.
Outbound HTTP GET requests originating from the Coder server to internal RFC1918 addresses or cloud metadata endpoints.
Repeated API 4xx responses referencing certificate fetch or Azure signature validation failures.

Detection Strategies

Enable verbose access logging on the Coder server and alert on repeated calls to the Azure identity endpoint from clients that never complete a workspace agent handshake.
Correlate inbound requests to the vulnerable endpoint with outbound network flows to detect unexpected egress patterns indicative of SSRF probing.
Deploy web application firewall (WAF) rules to inspect PKCS#7 payloads sent to /api/v2/workspaceagents/azure-instance-identity for anomalous certificate URL fields.

Monitoring Recommendations

Monitor egress traffic from Coder server hosts to internal subnets that should not receive Coder-originated requests.
Track HTTP response error rates on the affected endpoint to identify enumeration attempts.
Review authentication logs for patterns of failed Azure identity requests followed by unusual outbound DNS resolutions.

How to Mitigate CVE-2026-45796

Immediate Actions Required

Upgrade Coder to a patched release: 2.24.5, 2.29.13, 2.30.8, 2.31.12, 2.32.2, or 2.33.3 depending on your current branch.
If patching is not immediately possible, block or restrict access to /api/v2/workspaceagents/azure-instance-identity at the ingress layer.
Audit historical logs for prior requests to the vulnerable endpoint to identify potential reconnaissance activity.

Patch Information

The fix is delivered in Coder releases 2.24.5, 2.29.13, 2.30.8, 2.31.12, 2.32.2, and 2.33.3. The remediation is implemented in commit 57b11d405f17492aa789d4b9ff33366f961a37f8 and pull request #25274. Details are documented in the GHSA-686c-7vgv-v3fx security advisory.

Workarounds

If your deployment does not use the Azure identity-auth mechanism, restrict access to /api/v2/workspaceagents/azure-instance-identity via ingress firewall rules.
Apply reverse proxy Access Control Lists (ACLs) to deny external client requests to the endpoint while permitting legitimate Azure workspace agents only.
Segment the Coder server's egress network path to prevent it from reaching sensitive internal services and cloud metadata endpoints.

bash

# Example nginx ingress ACL blocking external access to the vulnerable endpoint
location = /api/v2/workspaceagents/azure-instance-identity {
    allow 10.0.0.0/8;
    deny  all;
    proxy_pass http://coder_backend;
}