CVE-2026-55427 coder CVE debrief

Who should care

Users of Coder versions prior to 2.29.7, 2.32.7, 2.33.8, and 2.34.2 who utilize remote development environments provisioned via Terraform should inspect their configurations and consider updating to patched versions to prevent potential SSH configuration injection.

Technical summary

The `coder config-ssh` command in Coder, prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, wrote server-supplied SSH settings (`HostnameSuffix`, `SSHConfigOptions`) into the user's `~/.ssh/config` without sanitizing embedded newlines or restricting directives. This could allow a malicious or compromised Coder server to inject arbitrary SSH configuration. The fix validates `HostnameSuffix` and `SSHConfigOptions` against a strict character set that rejects newlines and other control characters.

Defensive priority

High priority should be given to updating Coder installations to versions 2.29.7, 2.32.7, 2.33.8, or 2.34.2, or later, to mitigate the risk of arbitrary SSH configuration injection.

Recommended defensive actions

• Update Coder to version 2.29.7, 2.32.7, 2.33.8, or 2.34.2, or later.
• Inspect `coder config-ssh --dry-run` output before applying changes.
• Review and restrict access to Coder server configurations.
• Monitor for suspicious SSH configuration changes.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record was published on 2026-07-08T00:16:33.323Z and has not been modified since then. The NVD entry is currently 8.3 HIGH. Limited details are available regarding practical exploitation and affected scope.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.