CVE-2026-55427: Coder Remote Code Execution Vulnerability

CVE-2026-55427 Overview

CVE-2026-55427 is an SSH configuration injection vulnerability in Coder, a platform that provisions remote development environments through Terraform. The coder config-ssh command writes server-supplied SSH settings into the user's ~/.ssh/config file without sanitizing embedded newlines or restricting directives. A malicious or compromised Coder server can inject arbitrary SSH configuration directives by supplying crafted HostnameSuffix or SSHConfigOptions values. This weakness is classified as improper neutralization of special elements in output ([CWE-74]). Affected versions include all releases prior to 2.29.7, 2.32.7, 2.33.8, and 2.34.2.

Critical Impact
Attackers controlling a Coder server can inject arbitrary SSH directives into a developer's local configuration, redirecting connections, forcing key material exposure, or executing local commands through ProxyCommand and similar directives.

Affected Products

Coder versions prior to 2.29.7
Coder versions prior to 2.32.7
Coder versions prior to 2.33.8 and 2.34.2

Discovery Timeline

2026-07-08 - CVE-2026-55427 published to NVD
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-55427

Vulnerability Analysis

The coder config-ssh command generates entries in the user's ~/.ssh/config based on values returned by the Coder server. The client accepted the HostnameSuffix and SSHConfigOptions fields without validating their content. Because OpenSSH parses ~/.ssh/config line by line, any embedded newline in these values terminates the current directive and starts a new one. An attacker supplying a crafted string containing \n characters can insert arbitrary directives into the developer's SSH configuration.

Injected directives can include ProxyCommand, which executes a shell command every time the developer connects to any matched host. Other abusable directives include IdentityFile, User, Hostname, LocalForward, and RemoteForward, allowing credential redirection, host substitution, or port forwarding to attacker-controlled infrastructure.

Root Cause

The root cause is missing input validation on server-supplied strings written into a security-sensitive configuration file. The client trusted the server to provide well-formed values and performed no character allow-listing or newline filtering before serializing them into ~/.ssh/config.

Attack Vector

Exploitation requires the attacker to control the values the server returns. This is possible through a malicious deployment, a compromised Coder server, a man-in-the-middle position on the client-to-server channel, or administrative access to the HostnameSuffix and SSHConfigOptions settings. The user must then run coder config-ssh, which satisfies the user-interaction requirement. Once written, the injected configuration takes effect on the next SSH invocation.

See the GitHub Security Advisory GHSA-mcqq-fqgf-rxwm for full technical details.

Detection Methods for CVE-2026-55427

Indicators of Compromise

Unexpected directives in ~/.ssh/config under Coder-managed blocks, particularly ProxyCommand, LocalForward, RemoteForward, or IdentityFile entries not written by prior Coder versions.
Presence of shell metacharacters, URLs, or absolute paths inside HostnameSuffix or SSHConfigOptions values.
Outbound SSH connections from developer workstations to hosts not associated with the legitimate Coder deployment.

Detection Strategies

Compare the output of coder config-ssh --dry-run against the current ~/.ssh/config before applying changes.
Audit Coder server logs for administrative changes to HostnameSuffix and SSHConfigOptions fields.
Scan developer endpoints for ~/.ssh/config files containing directives inconsistent with organizational SSH policy.

Monitoring Recommendations

Alert on modifications to ~/.ssh/config on managed developer workstations, correlating with coder config-ssh process execution.
Monitor for spawn of subprocess chains originating from ssh invocations, which may indicate ProxyCommand injection.
Track Coder server version inventory to identify hosts still running vulnerable releases.

How to Mitigate CVE-2026-55427

Immediate Actions Required

Upgrade Coder to version 2.29.7, 2.32.7, 2.33.8, or 2.34.2 depending on the release branch in use.
Inspect ~/.ssh/config on all developer workstations that previously ran coder config-ssh and remove unauthorized directives.
Restrict administrative access to HostnameSuffix and SSHConfigOptions deployment settings.

Patch Information

The fix validates HostnameSuffix and SSHConfigOptions against a strict character set that rejects newlines and other control characters. Patched releases are available at GitHub Release v2.29.17, v2.32.7, v2.33.8, and v2.34.2. The corresponding code change is in GitHub Pull Request 26154.

Workarounds

Run coder config-ssh --dry-run and review the diff before applying any configuration changes.
Restrict who can modify server-side HostnameSuffix and SSHConfigOptions values to trusted administrators only.
Enforce TLS certificate validation on all Coder client-to-server connections to reduce man-in-the-middle exposure.

bash

# Inspect proposed SSH config changes before applying
coder config-ssh --dry-run | less

# After upgrade, verify installed Coder version
coder version