tocsin

Go/github.com/coder/coder/v2 CVE-2026-45796: unknown, EPSS 0.43%

Coder: Unauthenticated SSRF via Azure Instance Identity Endpoint in github.com/coder/coder

Action: Upgrade github.com/coder/coder/v2 to 2.24.5 or later.

go get github.com/coder/coder/v2@v2.24.5
go get github.com/coder/coder/v2@v2.29.13
go get github.com/coder/coder/v2@v2.30.8
go get github.com/coder/coder/v2@v2.31.12
go get github.com/coder/coder/v2@v2.32.2
go get github.com/coder/coder/v2@v2.33.3

Affected

introducedfixedlast affected
02.24.5-
2.29.02.29.13-
2.30.02.30.8-
2.31.02.31.12-
2.32.0-rc.02.32.2-
2.33.0-rc.02.33.3-

Fixed versions

2.24.52.29.132.30.82.31.122.32.22.33.3

Sources

CVE-2026-45796 · published · modified · JSON