Go/github.com/coder/coder/v2 CVE-2026-45796: medium 6.5, EPSS 0.43%
Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint
Action: Upgrade github.com/coder/coder/v2 to 2.24.5 or later.
go get github.com/coder/coder/v2@v2.33.3go get github.com/coder/coder/v2@v2.32.2go get github.com/coder/coder/v2@v2.31.12go get github.com/coder/coder/v2@v2.30.8go get github.com/coder/coder/v2@v2.29.13go get github.com/coder/coder/v2@v2.24.5Affected
| introduced | fixed | last affected |
|---|---|---|
| 2.33.0-rc.0 | 2.33.3 | - |
| 2.32.0-rc.0 | 2.32.2 | - |
| 2.31.0 | 2.31.12 | - |
| 2.30.0 | 2.30.8 | - |
| 2.29.0 | 2.29.13 | - |
| 0 | 2.24.5 | - |
Fixed versions
| 2.33.3 | 2.32.2 | 2.31.12 | 2.30.8 | 2.29.13 | 2.24.5 |
Sources
- osv: GHSA-686c-7vgv-v3fx
- https://github.com/coder/coder/security/advisories/GHSA-686c-7vgv-v3fx
- https://github.com/coder/coder/pull/25274
- https://github.com/coder/coder/commit/57b11d405f17492aa789d4b9ff33366f961a37f8
- https://github.com/coder/coder
- https://github.com/coder/coder/releases/tag/v2.24.5
- https://github.com/coder/coder/releases/tag/v2.29.13
- https://github.com/coder/coder/releases/tag/v2.30.8
- https://github.com/coder/coder/releases/tag/v2.31.12
- https://github.com/coder/coder/releases/tag/v2.32.2
- https://github.com/coder/coder/releases/tag/v2.33.3
CVE-2026-45796 · published · modified · JSON