CVE-2026-45796

Executive Summary

CVE-2026-45796 is a semi-blind Server-Side Request Forgery (SSRF) vulnerability in Coder, an open-source platform for provisioning remote development environments via Terraform. The flaw resides in the /api/v2/workspaceagents/azure-instance-identity endpoint, which is used for Azure instance identity authentication. An unauthenticated attacker can craft a malicious PKCS#7 signature to force the Coder server to issue HTTP GET requests to arbitrary internal or external hosts. While the response body is not returned, error messages in the API response reveal whether the target is reachable and the type of failure, enabling network reconnaissance and potential internal service probing.

The vulnerability affects all Coder versions prior to the patched releases: 2.24.5, 2.29.13, 2.30.8, 2.31.12, 2.32.2, and 2.33.3. The CVSS score is 6.5 (Medium), with a vector emphasizing network-based, low-complexity, unauthenticated exploitation. No public exploit code or PoC is available at this time, but the attack surface is significant for organizations using Coder in internal networks.

Supply Chain & Package Security

Coder is a Go-based application distributed as a binary or container image. The vulnerability is in the server-side API handler, not in a package dependency. However, organizations using Coder should verify their deployment version and ensure they are on a patched release. No malicious packages or compromised dependencies have been reported in connection with this CVE.

CVSS Breakdown & Threat Level

• CVSS Score: 6.5 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
• Attack Vector (AV): Network – exploitable remotely.
• Attack Complexity (AC): Low – no special conditions required.
• Privileges Required (PR): None – unauthenticated.
• User Interaction (UI): None – no user action needed.
• Scope (S): Unchanged – the vulnerable component is the only affected system.
• Confidentiality (C): Low – limited information disclosure via error messages.
• Integrity (I): None – no data modification possible.
• Availability (A): Low – potential for denial of service by targeting internal services.

Threat Level: Medium. The SSRF is semi-blind, meaning the attacker cannot read response bodies but can infer reachability and error types. This can be used for internal network mapping, identifying live hosts, and potentially triggering actions on internal services (e.g., health checks, logging endpoints). The lack of authentication lowers the barrier to entry.

Deep Dive & Mechanics

The vulnerability exists in the Azure instance identity authentication mechanism. Coder uses this endpoint to verify that a workspace agent is running on an Azure VM by checking the Azure Instance Metadata Service (IMDS). The endpoint accepts a PKCS#7 signature that should be generated by the Azure IMDS. However, the server does not properly validate that the signature originates from the Azure IMDS endpoint. Instead, it uses the signature to construct an HTTP GET request to a URL derived from the signature's content.

Attack Flow:

1. An attacker crafts a PKCS#7 signature that contains a target URL (e.g., http://internal-service:8080/health).
2. The attacker sends a POST request to /api/v2/workspaceagents/azure-instance-identity with the crafted signature.
3. The Coder server parses the signature and issues an HTTP GET request to the attacker-specified URL.
4. The server does not return the response body, but error messages (e.g., "connection refused", "timeout", "HTTP 200") are reflected in the API response.
5. The attacker can iterate over internal IPs and ports to map the network and identify live services.

Why Semi-Blind: The attacker cannot see the actual response content, but can distinguish between different failure modes (e.g., host unreachable vs. service responding with an error). This is sufficient for reconnaissance.

Affected Endpoint: POST /api/v2/workspaceagents/azure-instance-identity

Vulnerable vs. Patched Code

The vulnerable code likely constructs the HTTP request without validating that the target URL is the Azure IMDS endpoint (169.254.169.254). The patched code adds validation to ensure the request is only sent to the legitimate Azure IMDS endpoint.

Vulnerable (pseudo-code):

func handleAzureIdentity(w http.ResponseWriter, r *http.Request) {
    signature := parsePKCS7(r.Body)
    targetURL := extractURLFromSignature(signature) // No validation
    resp, err := http.Get(targetURL) // SSRF
    // ...
}

Patched (pseudo-code):

func handleAzureIdentity(w http.ResponseWriter, r *http.Request) {
    signature := parsePKCS7(r.Body)
    targetURL := extractURLFromSignature(signature)
    if !isAzureIMDSEndpoint(targetURL) { // Added validation
        http.Error(w, "Invalid target", 400)
        return
    }
    resp, err := http.Get(targetURL)
    // ...
}

The patch ensures that only requests to 169.254.169.254 (Azure IMDS) are allowed, preventing SSRF to arbitrary hosts.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• A Coder server running a vulnerable version (e.g., 2.24.4).
• Network access to the Coder API endpoint.
• Knowledge of internal IP ranges (optional, for targeted scanning).

Step-by-Step Exploitation:

1. Craft a malicious PKCS#7 signature that encodes a target URL. The signature format is specific to Azure IMDS, but an attacker can manipulate the embedded URL. For example, using a tool like openssl to create a PKCS#7 structure with a custom URL.

2. Send the POST request:

curl -X POST https://coder.example.com/api/v2/workspaceagents/azure-instance-identity \
  -H "Content-Type: application/pkcs7-signature" \
  --data-binary @malicious_signature.p7b

3. Analyze the response: The server will return an error message indicating the result of the HTTP GET request. For example:

   • "connection refused" – host is up but port is closed.
   • "timeout" – host is unreachable or firewall is blocking.
   • "HTTP 200" – service is responding.

4. Iterate over targets: Use a script to scan internal IPs and ports:

import requests
import base64

targets = ["10.0.0.1:80", "10.0.0.1:443", "10.0.0.2:8080"]
for target in targets:
    # Craft signature for target
    signature = craft_pkcs7(target)
    resp = requests.post("https://coder.example.com/api/v2/workspaceagents/azure-instance-identity",
                         data=signature,
                         headers={"Content-Type": "application/pkcs7-signature"})
    print(f"{target}: {resp.text}")

Expected Outcome: The attacker can map internal services, identify live hosts, and potentially trigger actions on internal endpoints (e.g., health checks, logging).

Blue Team (Defense & Detection)

Detection Steps:

1. Monitor API logs for requests to /api/v2/workspaceagents/azure-instance-identity from unexpected IPs or with unusual payloads.
2. Check for outbound HTTP requests from the Coder server to internal IPs that are not the Azure IMDS endpoint (169.254.169.254).
3. Analyze PKCS#7 signatures for non-Azure URLs.

Honeypot Strategy:

• Deploy a fake internal service that logs all requests. If the Coder server contacts it, an SSRF attack is in progress.

Mitigation:

• Apply the patch immediately.
• If the Azure identity-auth mechanism is not used, block access to the endpoint via firewall or proxy ACLs.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Outbound HTTP requests from the Coder server to internal IPs (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) on any port.
  • Requests to the Azure IMDS endpoint (169.254.169.254) from unexpected sources.
• Log IOCs:
  • API logs showing repeated POST requests to /api/v2/workspaceagents/azure-instance-identity with varying payloads.
  • Error messages in logs indicating connection attempts to internal hosts.
• File IOCs:
  • Unusual PKCS#7 signature files on the Coder server (e.g., in /tmp/).

Detection Engineering

YARA Rule

rule CVE_2026_45796_SSRF_PKCS7 {
    meta:
        description = "Detects malicious PKCS#7 signatures targeting Coder SSRF vulnerability"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2026-45796"
    strings:
        $pkcs7_header = "PKCS7" ascii wide nocase
        $http_url = /http:\/\/[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}/ ascii
        $internal_ip = /(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.)/ ascii
    condition:
        $pkcs7_header and $http_url and $internal_ip
}

Sigma Rule

title: Coder SSRF via Azure Instance Identity Endpoint
id: 8f4c3b2a-1d5e-4f7a-9c8b-0e2f3a4b5c6d
status: experimental
description: Detects exploitation attempts of CVE-2026-45796 by monitoring outbound HTTP requests from Coder server to internal IPs.
author: Valters IT
date: 2025-04-10
logsource:
    category: network_connection
    product: windows
    service: sysmon
detection:
    selection:
        Image|endswith: '\coder-server.exe'
        DestinationIp|startswith:
            - '10.'
            - '172.16.'
            - '172.17.'
            - '172.18.'
            - '172.19.'
            - '172.20.'
            - '172.21.'
            - '172.22.'
            - '172.23.'
            - '172.24.'
            - '172.25.'
            - '172.26.'
            - '172.27.'
            - '172.28.'
            - '172.29.'
            - '172.30.'
            - '172.31.'
            - '192.168.'
        DestinationPort:
            - 80
            - 443
            - 8080
            - 8443
    condition: selection
falsepositives:
    - Legitimate Azure IMDS requests (169.254.169.254)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-45796 Coder SSRF Azure Instance Identity"; flow:to_server; content:"POST"; http_method; content:"/api/v2/workspaceagents/azure-instance-identity"; http_uri; content:"Content-Type|3a| application/pkcs7-signature"; http_header; pcre:"/http:\/\/(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.)/"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Coder to one of the patched versions: 2.24.5, 2.29.13, 2.30.8, 2.31.12, 2.32.2, or 2.33.3.
2. If upgrade is not possible, restrict access to the /api/v2/workspaceagents/azure-instance-identity endpoint using:
   • Ingress firewall rules (allow only trusted IPs).
   • Reverse proxy ACLs (e.g., Nginx allow/deny directives).
3. Disable Azure identity-auth if not in use.

Long-Term Measures:

• Implement network segmentation to limit the impact of SSRF.
• Use Web Application Firewall (WAF) rules to block requests with suspicious PKCS#7 payloads.
• Monitor for outbound HTTP requests from the Coder server to internal IPs.
• Conduct regular security audits of API endpoints.

Workaround (if patching is delayed):

location /api/v2/workspaceagents/azure-instance-identity {
    deny all;
    return 403;
}

Valters IT
DevSecOps & Cyber Threat Intelligence