PatchSiren cyber security CVE debrief
CVE-2026-45796 coder CVE debrief
The CVE record for CVE-2026-45796 was published on 2026-07-07T22:16:52.317Z and has not been modified since then. The vulnerability is an unauthenticated semi-blind Server-Side Request Forgery (SSRF) in Coder via the Azure instance identity endpoint (POST /api/v2/workspaceagents/azure-instance-identity). An external attacker can force the Coder server to issue HTTP GET requests to arbitrary internal or external hosts by submitting a crafted PKCS#7 signature. The server does not return the target's response body, but error messages in the API response reveal whether the target is reachable and what type of failure occurred. Users of Coder versions prior to 2.24.5, 2.29.13, 2.30.8, 2.31.12, 2.32.2, and 2.33.3 who utilize the Azure instance identity endpoint should be aware of this vulnerability.
- Vendor
- coder
- Product
- Unknown
- CVSS
- MEDIUM 6.5
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-07-07
- Original CVE updated
- 2026-07-07
- Advisory published
- 2026-07-07
- Advisory updated
- 2026-07-07
Who should care
Users of Coder versions prior to 2.24.5, 2.29.13, 2.30.8, 2.31.12, 2.32.2, and 2.33.3 who utilize the Azure instance identity endpoint should be aware of this vulnerability. This includes operators, platform administrators, vulnerability management teams, and security teams who need to assess the risk and implement mitigations.
Technical summary
Unauthenticated semi-blind Server-Side Request Forgery (SSRF) vulnerability in Coder via the Azure instance identity endpoint (POST /api/v2/workspaceagents/azure-instance-identity). An external attacker can force the Coder server to issue HTTP GET requests to arbitrary internal or external hosts by submitting a crafted PKCS#7 signature. The server does not return the target's response body, but error messages in the API response reveal whether the target is reachable and what type of failure occurred.
Defensive priority
Medium priority due to the CVSS score of 6.5 and the potential for SSRF attacks.
Recommended defensive actions
- Upgrade to Coder versions 2.24.5, 2.29.13, 2.30.8, 2.31.12, 2.32.2, or 2.33.3.
- Restrict access to the corresponding endpoint (/api/v2/workspaceagents/azure-instance-identity) using ingress firewall and/or proxy ACLs if the Azure identity-auth mechanism is not being used.
- Monitor API responses for suspicious error messages that could indicate SSRF activity.
- Review compensating controls for exposed systems while remediation is scheduled and verified.
- Check relevant monitoring, detection, and logs for exposed assets that need extra review.
- Track exceptions, retest remediated assets, and close the item only after evidence is documented.
- Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
Evidence notes
Evidence is based on limited information from the CVE record and NVD detail. Further investigation is recommended to fully understand the vulnerability and its potential impact. The CVE record was published on 2026-07-07T22:16:52.317Z and has not been modified since then. The vulnerability affects Coder versions prior to 2.24.5, 2.29.13, 2.30.8, 2.31.12, 2.32.2, and 2.33.3. The Azure instance identity endpoint is vulnerable to unauthenticated semi-blind Server-Side Request Forgery (SSRF).
Official resources
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-07T22:16:52.317Z and has not been modified since then.