CVE-2026-45796

Description

Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint

Overview

State

—

Assigner (CNA)

—

CVSS severity

medium

CVSS score

6.5 / 10

CVSS vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Effective score

6.5 / 10 MEDIUM source: CNA overview

CWE(s)

—

Reserved

—

Published

—

Last updated

—

Source

https://www.tenable.com/cve/CVE-2026-45796

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID

EUVD-2026-42108

Assigner

GitHub_M

Published

Jul 7, 2026, 9:03:11 PM

Updated

Jul 8, 2026, 1:53:41 PM

EUVD base score (CVSS 3.1)

6.5 / 10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

EUVD-reported EPSS

0.3300

Vendors

coder

Products

coder (< 2.24.5)

coder (2.30.0, < 2.30.8)

coder (2.31.0, < 2.31.12)

coder (2.33.0-rc.0, < 2.33.3)

coder (2.32.0-rc.0, < 2.32.2)

coder (2.29.0, < 2.29.13)

Aliases

GHSA-686c-7vgv-v3fx

ENISA description: Coder allows organizations to provision remote development environments via Terraform. Versions prior tp 2.24.5, 2.29.13, 2.30.8, 2.31.12, 2.32.2, and 2.33.3 are vulnerable to unauthenticated semi-blind Server-Side Request Forgery (SSRF) via the Azure instance identity endpoint (`POST /api/v2/workspaceagents/azure-instance-identity`). An external attacker can force the Coder server to issue HTTP GET requests to arbitrary internal or external hosts by submitting a crafted PKCS#7 signature. The server does not return the target's response body, but error messages in the API response reveal whether the target is reachable and what type of failure occurred. Versions 2.24.5, 2.29.13, 2.30.8, 2.31.12, 2.32.2, and 2.33.3 patch the issue. As a workaround, if the Azure identity-auth mechanism is not being used then restrict access to the corresponding endpoint (`/api/v2/workspaceagents/azure-instance-identity`) using ingress firewall and/or proxy ACLs.

Vendor references (0)

References embedded in the original CVE record by the assigning CNA.

None in the CVE record.

Web references (2)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

• https://nvd.nist.gov/vuln/detail/CVE-2026-45796 tenable:nvd.nist.gov
• https://www.cve.org/CVERecord?id=CVE-2026-45796 tenable:www.cve.org

• Update Software, Mitigation M1051 - Enterprise | MITRE ATT&CK®
  web:attack.mitre.org

  This mitigation can be implemented through the following measures: Regular Operating System Updates Implementation: Apply the latest Windows security updates monthly using WSUS (Windows Server Update Services) or a similar patch management solution. Configure systems to check for updates automatically and schedule reboots during maintenance ...

  2026-05-26 03:08 UTC
• Security Update Guide - Microsoft Security Response Center
  web:msrc.microsoft.com

  Security Update Guide - Microsoft Security Response Center

  2026-05-26 03:08 UTC
• Vulnerability Remediation vs Mitigation: Which Strategy Wins in ...
  web:securityboulevard.com

  Cybersecurity vulnerabilities pose significant risks to organizations in today's digital landscape. Left unaddressed, these vulnerabilities can lead to data breaches, financial losses, and reputational damage. Organizations must decide how to tackle vulnerabilities—through remediation , mitigation , or a combination of both. But which strategy is more effective? This blog explores the ...

  2026-05-26 03:08 UTC
• Vulnerability Mitigation vs. Remediation: What Is the Difference?
  web:virsec.com

  In one of them, mitigation is a form of remediation . In another, it's a contrasting concept. However, the distinction between vulnerability mitigation and remediation is not just semantic; it's operational. Remediation offers a definitive, long-term vulnerability fix , but its time and resource demands make it insufficient on its own.

  2026-05-26 03:08 UTC
• CVE: Common Vulnerabilities and Exposures
  web:www.cve.org

  At cve .org, we provide the authoritative reference method for publicly known information-security vulnerabilities and exposures

  2026-05-26 03:08 UTC
• Vulnerability Mitigation and Remediation Strategies - Ontinue
  web:www.ontinue.com

  Mitigation helps identify and manage vulnerabilities, and if the resources and skills are available, those weaknesses can move from mitigation to remediation . Mitigation is often the answer instead of remediation for issues like: A fix or patch of software isn't immediately available, so the update that would remediate the issue is postponed.

  2026-05-26 03:08 UTC
• Critical Patch Updates, Critical Security Patch Updates ... - Oracle
  web:www.oracle.com

  Critical Security Patch Updates Critical Security Patch Updates provide security patches for supported Oracle on-premises products. A Critical Security Patch Update provides targeted, high-priority security fixes in a smaller, more focused format, making them easier to apply with minimal disruption.

  2026-05-26 03:08 UTC
• Vulnerability Remediation vs. Mitigation: What are the Differences ...
  web:www.secure.com

  Learn the difference between vulnerability remediation and mitigation , and how a risk-based strategy can strengthen your security posture.

  2026-05-26 03:08 UTC
• Vulnerability Remediation vs Mitigation: Which is Best?
  web:www.strongboxit.com

  Learn the key differences between vulnerability remediation vs mitigation in cybersecurity. Discover which method is effective for protecting your data.

  2026-05-26 03:08 UTC
• Strategies for Improving Mitigation & Remediation - Vuln Management ...
  web:www.zafran.io

  Mitigation is the control implemented or the action taken to reduce the impact or likelihood of a vulnerability or exposure being exploited before a fix is available or applied. Remediation is the resolution of the vulnerability or exposure which is completed typically through applying patches, updates, or correcting misconfigurations.

  2026-05-26 03:08 UTC

Only Available for Registered Users. Sign in to view.