CVE-2026-46354
Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft
Severidad por fuente
La etiqueta propia de Trivy es CRITICAL. Crítica según GHSA.
Descripción
Coder allows organizations to provision remote development environments via Terraform. In versions prior tp 2.24.5, 2.29.13, 2.30.8, 2.31.12, 2.32.2, and 2.33.3, `azureidentity.Validate()` verifies that the PKCS#7 signer certificate chains to a trusted Azure CA but never verifies the PKCS#7 signature itself. An attacker can embed a legitimate Azure certificate alongside arbitrary content e.g. `{"vmId":"<target>"}` and the forged `vmId` will be accepted returning the victim workspace agent's session token. No authentication is required. The attacker only needs to know a target VM's `vmId` which is a `UUIDv4`. That's a practical limitation which would typically require prior access to be exploited. Versions 2.24.5, 2.29.13, 2.30.8, 2.31.12, 2.32.2, and 2.33.3 patch the issue. As a workaround, reconfigure any Azure templates to use token authentication rather than `azure-instance-identity`.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| go::GitHub Security Advisory Go | github.com/coder/coder, github.com/coder/coder/v2 | 2.33.3, 2.32.2, 2.31.12, 2.30.8, 2.29.13, 2.24.5 |
Mostrar las 2 entradas de 1 fuente
| Fuente | Paquete | Corregido en |
|---|---|---|
| go::GitHub Security Advisory Go | github.com/coder/coder | sin corrección indicada |
| go::GitHub Security Advisory Go | github.com/coder/coder/v2 | 2.33.3, 2.32.2, 2.31.12, 2.30.8, 2.29.13, 2.24.5 |
Referencias
- https://github.com/coder/coder
- https://github.com/coder/coder/pull/25286
- https://github.com/coder/coder/releases/tag/v2.24.5
- https://github.com/coder/coder/releases/tag/v2.29.13
- https://github.com/coder/coder/releases/tag/v2.30.8
- https://github.com/coder/coder/releases/tag/v2.31.12
- https://github.com/coder/coder/releases/tag/v2.32.2
- https://github.com/coder/coder/releases/tag/v2.33.3