Skip to content

Back to the catalog

Orca Security: Critical Coder Signature Bypass Exposes Developer Keys and Tokens
orca.securityadvisory

Orca Security: Critical Coder Signature Bypass Exposes Developer Keys and Tokens

Orca analysis of CVE-2026-46354 (CVSS 9.1) in the Coder remote development platform. azureidentity.Validate() checks that the PKCS#7 signer certificate chains to a trusted Azure CA but never verifies the signature on the envelope. An unauthenticated attacker can send a forged envelope, using a public Azure IMDS certificate and a known vmId, to POST /api/v2/workspaceagents/azure-instance-identity. This yields workspace agent session tokens, and through them Git SSH keys and OAuth tokens. The post lists the affected v2 and v1 versions, the patched releases (v2.33.3, v2.32.2, v2.31.12, v2.30.8, v2.29.13, v2.24.5) and the workaround of disabling Azure instance identity auth. Coder v1 has no patch.

TL;DR Coder CVE-2026-46354: the Azure instance-identity PKCS#7 signature is never verified, so an unauthenticated attacker can mint workspace agent tokens and steal Git SSH keys and OAuth tokens.
Open original ↗

Organisations named here

  • ANT-2026-22445
  • Ben Tran
  • PKCS#7 signature bypass

CVEs named here

  • CVE-2026-46354

Technologies named here

  • Coder v2 v2.33.0-rc.0 through v2.33.2
  • Coder v2 v2.32.0-rc.0 through v2.32.1
  • Certificate Transparency logs
  • Coder v2 v2.31.0 through v2.31.11
  • Coder v2 v2.30.0 through v2.30.7
  • Coder v2 v2.29.0 through v2.29.12
  • Coder v2 all versions prior to v2.24.5
  • Coder v1, no patch available
  • Coder v2.33.0-rc.0 through v2.33.2
  • Orca Security Platform
  • Coder v2.32.0-rc.0 through v2.32.1
  • Coder v2.31.0 through v2.31.11
  • Coder v2.30.0 through v2.30.7
  • Coder v2.29.0 through v2.29.12
  • Azure
  • OAuth
  • SSH
  • CVSS
  • Anthropic
  • Coder

Threat actors named here

  • Calif.IO

Related in AppSec