Go/github.com/coder/coder CVE-2026-46354: critical 9.1, EPSS 0.32%
Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft
Action: No fix published. Pin and monitor.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | - | 0.27.3 |
Fixed versions
No fixed version in the source.
Sources
- osv: GHSA-6x44-w3xg-hqqf#Go/github.com/coder/coder
- https://github.com/coder/coder/security/advisories/GHSA-6x44-w3xg-hqqf
- https://github.com/coder/coder/pull/25286
- https://github.com/coder/coder
- https://github.com/coder/coder/releases/tag/v2.24.5
- https://github.com/coder/coder/releases/tag/v2.29.13
- https://github.com/coder/coder/releases/tag/v2.30.8
- https://github.com/coder/coder/releases/tag/v2.31.12
- https://github.com/coder/coder/releases/tag/v2.32.2
- https://github.com/coder/coder/releases/tag/v2.33.3
CVE-2026-46354 · published · modified · JSON