CVE-2026-46354
4 advisories.
Go/github.com/coder/coder/v2 CVE-2026-46354: critical 9.1, EPSS 0.32%
Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft
Action: Upgrade github.com/coder/coder/v2 to 2.24.5 or later.
go get github.com/coder/coder/v2@v2.33.3go get github.com/coder/coder/v2@v2.32.2go get github.com/coder/coder/v2@v2.31.12go get github.com/coder/coder/v2@v2.30.8go get github.com/coder/coder/v2@v2.29.13go get github.com/coder/coder/v2@v2.24.5Affected
| introduced | fixed | last affected |
|---|---|---|
| 2.33.0-rc.0 | 2.33.3 | - |
| 2.32.0-rc.0 | 2.32.2 | - |
| 2.31.0 | 2.31.12 | - |
| 2.30.0 | 2.30.8 | - |
| 2.29.0 | 2.29.13 | - |
| 0 | 2.24.5 | - |
Fixed versions
| 2.33.3 | 2.32.2 | 2.31.12 | 2.30.8 | 2.29.13 | 2.24.5 |
Sources
- osv: GHSA-6x44-w3xg-hqqf
- https://github.com/coder/coder/security/advisories/GHSA-6x44-w3xg-hqqf
- https://github.com/coder/coder/pull/25286
- https://github.com/coder/coder
- https://github.com/coder/coder/releases/tag/v2.24.5
- https://github.com/coder/coder/releases/tag/v2.29.13
- https://github.com/coder/coder/releases/tag/v2.30.8
- https://github.com/coder/coder/releases/tag/v2.31.12
- https://github.com/coder/coder/releases/tag/v2.32.2
- https://github.com/coder/coder/releases/tag/v2.33.3
CVE-2026-46354 · published · modified · JSON
Go/github.com/coder/coder CVE-2026-46354: critical 9.1, EPSS 0.32%
Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft
Action: No fix published. Pin and monitor.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | - | 0.27.3 |
Fixed versions
No fixed version in the source.
Sources
- osv: GHSA-6x44-w3xg-hqqf#Go/github.com/coder/coder
- https://github.com/coder/coder/security/advisories/GHSA-6x44-w3xg-hqqf
- https://github.com/coder/coder/pull/25286
- https://github.com/coder/coder
- https://github.com/coder/coder/releases/tag/v2.24.5
- https://github.com/coder/coder/releases/tag/v2.29.13
- https://github.com/coder/coder/releases/tag/v2.30.8
- https://github.com/coder/coder/releases/tag/v2.31.12
- https://github.com/coder/coder/releases/tag/v2.32.2
- https://github.com/coder/coder/releases/tag/v2.33.3
CVE-2026-46354 · published · modified · JSON
Go/github.com/coder/coder CVE-2026-46354: unknown, EPSS 0.32%
Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder
Action: No fix published. Pin and monitor.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | - | - |
Fixed versions
No fixed version in the source.
Sources
- osv: GO-2026-5196
- https://github.com/coder/coder/security/advisories/GHSA-6x44-w3xg-hqqf
- https://github.com/coder/coder/pull/25286
- https://github.com/coder/coder/releases/tag/v2.24.5
- https://github.com/coder/coder/releases/tag/v2.29.13
- https://github.com/coder/coder/releases/tag/v2.30.8
- https://github.com/coder/coder/releases/tag/v2.31.12
- https://github.com/coder/coder/releases/tag/v2.32.2
- https://github.com/coder/coder/releases/tag/v2.33.3
CVE-2026-46354 · published · modified · JSON
Go/github.com/coder/coder/v2 CVE-2026-46354: unknown, EPSS 0.32%
Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft in github.com/coder/coder
Action: Upgrade github.com/coder/coder/v2 to 2.24.5 or later.
go get github.com/coder/coder/v2@v2.24.5go get github.com/coder/coder/v2@v2.29.13go get github.com/coder/coder/v2@v2.30.8go get github.com/coder/coder/v2@v2.31.12go get github.com/coder/coder/v2@v2.32.2go get github.com/coder/coder/v2@v2.33.3Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2.24.5 | - |
| 2.29.0 | 2.29.13 | - |
| 2.30.0 | 2.30.8 | - |
| 2.31.0 | 2.31.12 | - |
| 2.32.0-rc.0 | 2.32.2 | - |
| 2.33.0-rc.0 | 2.33.3 | - |
Fixed versions
| 2.24.5 | 2.29.13 | 2.30.8 | 2.31.12 | 2.32.2 | 2.33.3 |
Sources
- osv: GO-2026-5196#Go/github.com/coder/coder/v2
- https://github.com/coder/coder/security/advisories/GHSA-6x44-w3xg-hqqf
- https://github.com/coder/coder/pull/25286
- https://github.com/coder/coder/releases/tag/v2.24.5
- https://github.com/coder/coder/releases/tag/v2.29.13
- https://github.com/coder/coder/releases/tag/v2.30.8
- https://github.com/coder/coder/releases/tag/v2.31.12
- https://github.com/coder/coder/releases/tag/v2.32.2
- https://github.com/coder/coder/releases/tag/v2.33.3
CVE-2026-46354 · published · modified · JSON