CVE-2026-463549.1CriticalCWE-347

CVE-2026-46354: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft

coder

Affected: coder · Exploitation: unlikely (under 1%)

Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.

0.3%probability of exploitation in the next 30 days

25th percentile

050100

Higher than 25% of scored CVEs

9.1CriticalCVSS 3.1

LowMediumHighCrit.

DescriptionCVE.org

Coder allows organizations to provision remote development environments via Terraform. In versions prior tp 2.24.5, 2.29.13, 2.30.8, 2.31.12, 2.32.2, and 2.33.3, `azureidentity.Validate()` verifies that the PKCS#7 signer certificate chains to a trusted Azure CA but never verifies the PKCS#7 signature itself. An attacker can embed a legitimate Azure certificate alongside arbitrary content e.g. `{"vmId":"<target>"}` and the forged `vmId` will be accepted returning the victim workspace agent's session token. No authentication is required. The attacker only needs to know a target VM's `vmId` which is a `UUIDv4`. That's a practical limitation which would typically require prior access to be exploited. Versions 2.24.5, 2.29.13, 2.30.8, 2.31.12, 2.32.2, and 2.33.3 patch the issue. As a workaround, reconfigure any Azure templates to use token authentication rather than `azure-instance-identity`.

Affected products1

From the CVE record. A product or version that is not listed is unknown, not unaffected.

coder · coder>= 2.33.0-rc.0, < 2.33.3; >= 2.32.0-rc.0, < 2.32.2; >= 2.31.0, < 2.31.12; >= 2.30.0, < 2.30.8; >= 2.29.0, < 2.29.13; < 2.24.5

On the Atlas

Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.

Open the Atlas

Exploitation: Unlikely (under 1%). EPSS under 1%, or no score yet.
CISA KEV: Not listed
Public check: No public nuclei template
Weakness: Improper Verification of Cryptographic Signature · Cryptography
Vendor: coder
Published: July 2026
Band: Unlikely (under 1%), July 2026

CoverageNo articles yet

No CyberSIXT article names CVE-2026-46354 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.