CVE-2026-46354
Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft
Einstufung nach Quelle
Trivys eigenes Label ist CRITICAL. Kritisch laut GHSA.
Beschreibung
Coder allows organizations to provision remote development environments via Terraform. In versions prior tp 2.24.5, 2.29.13, 2.30.8, 2.31.12, 2.32.2, and 2.33.3, `azureidentity.Validate()` verifies that the PKCS#7 signer certificate chains to a trusted Azure CA but never verifies the PKCS#7 signature itself. An attacker can embed a legitimate Azure certificate alongside arbitrary content e.g. `{"vmId":"<target>"}` and the forged `vmId` will be accepted returning the victim workspace agent's session token. No authentication is required. The attacker only needs to know a target VM's `vmId` which is a `UUIDv4`. That's a practical limitation which would typically require prior access to be exploited. Versions 2.24.5, 2.29.13, 2.30.8, 2.31.12, 2.32.2, and 2.33.3 patch the issue. As a workaround, reconfigure any Azure templates to use token authentication rather than `azure-instance-identity`.
Betroffene Pakete und behobene Versionen
| Quelle | Paket | Behoben in |
|---|---|---|
| go::GitHub Security Advisory Go | github.com/coder/coder, github.com/coder/coder/v2 | 2.33.3, 2.32.2, 2.31.12, 2.30.8, 2.29.13, 2.24.5 |
Alle 2 Einträge aus 1 Quelle zeigen
| Quelle | Paket | Behoben in |
|---|---|---|
| go::GitHub Security Advisory Go | github.com/coder/coder | kein Fix angegeben |
| go::GitHub Security Advisory Go | github.com/coder/coder/v2 | 2.33.3, 2.32.2, 2.31.12, 2.30.8, 2.29.13, 2.24.5 |
Referenzen
- https://github.com/coder/coder
- https://github.com/coder/coder/pull/25286
- https://github.com/coder/coder/releases/tag/v2.24.5
- https://github.com/coder/coder/releases/tag/v2.29.13
- https://github.com/coder/coder/releases/tag/v2.30.8
- https://github.com/coder/coder/releases/tag/v2.31.12
- https://github.com/coder/coder/releases/tag/v2.32.2
- https://github.com/coder/coder/releases/tag/v2.33.3