GHSA-PW9R-H2M6-6VVG vulnerabilities

Vulnerabilities for packages: linux-azure, linux-vmware, linux-aws, linux-gcp, linux-qemu-melange, linux-qemu...

CVE-2026-53205 vulnerabilities

Vulnerabilities for packages: linux-azure, linux-vmware, linux-aws, linux-gcp, linux-qemu-melange, linux-qemu...

CVE-2026-53210 vulnerabilities

Vulnerabilities for packages: linux-azure, linux-vmware, linux-aws, linux-gcp, linux-qemu-melange, linux-qemu...

CVE-2026-53214 vulnerabilities

Vulnerabilities for packages: linux-azure, linux-vmware, linux-aws, linux-gcp, linux-qemu-melange, linux-qemu...

CVE-2026-53215 vulnerabilities

Vulnerabilities for packages: linux-azure, linux-vmware, linux-aws, linux-gcp, linux-qemu-melange, linux-qemu...

CVE-2026-53220 vulnerabilities

Vulnerabilities for packages: linux-azure, linux-vmware, linux-aws, linux-gcp, linux-qemu-melange, linux-qemu...

CVE-2026-53221 vulnerabilities

Vulnerabilities for packages: linux-azure, linux-vmware, linux-aws, linux-gcp, linux-qemu-melange, linux-qemu...

GHSA-3886-873F-6XPF vulnerabilities

Vulnerabilities for packages: linux-azure, linux-vmware, linux-aws, linux-gcp, linux-qemu-melange, linux-qemu...

GHSA-9MPH-4HQC-XQX7 vulnerabilities

Vulnerabilities for packages: linux-azure, linux-vmware, linux-aws, linux-gcp, linux-qemu-melange, linux-qemu...

GHSA-JPVF-6235-4RH8 vulnerabilities

Vulnerabilities for packages: linux-azure, linux-vmware, linux-aws, linux-gcp, linux-qemu-melange, linux-qemu...

CVE-2026-46354

Coder allows organizations to provision remote development environments via Terraform. In versions prior tp 2.24.5, 2.29.13, 2.30.8, 2.31.12, 2.32.2, and 2.33.3, azureidentity.Validate verifies that the PKCS7 signer certificate chains to a trusted Azure CA but never verifies the PKCS7 signature...

CVE-2026-45796

Coder allows organizations to provision remote development environments via Terraform. Versions prior tp 2.24.5, 2.29.13, 2.30.8, 2.31.12, 2.32.2, and 2.33.3 are vulnerable to unauthenticated semi-blind Server-Side Request Forgery SSRF via the Azure instance identity endpoint POST...

CVE-2026-46354 Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft

Coder allows organizations to provision remote development environments via Terraform. In versions prior tp 2.24.5, 2.29.13, 2.30.8, 2.31.12, 2.32.2, and 2.33.3, azureidentity.Validate verifies that the PKCS7 signer certificate chains to a trusted Azure CA but never verifies the PKCS7 signature...

CVE-2026-46354

Summary: A PKCS#7 signature bypass in Coder (Coder v2 before patches) allows unauthenticated token theft via Azure instance identity. The issue stems from azureidentity.Validate() validating only the signer certificate chain, not the signature itself, enabling forged PKCS#7 envelopes containing a...

CVE-2026-46354 Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft

Coder allows organizations to provision remote development environments via Terraform. In versions prior tp 2.24.5, 2.29.13, 2.30.8, 2.31.12, 2.32.2, and 2.33.3, azureidentity.Validate verifies that the PKCS7 signer certificate chains to a trusted Azure CA but never verifies the PKCS7 signature...

CVE-2026-45796 Coder vulnerable to unauthenticated SSRF via Azure Instance Identity Endpoint

Coder allows organizations to provision remote development environments via Terraform. Versions prior tp 2.24.5, 2.29.13, 2.30.8, 2.31.12, 2.32.2, and 2.33.3 are vulnerable to unauthenticated semi-blind Server-Side Request Forgery SSRF via the Azure instance identity endpoint POST...

CVE-2026-45796 Coder vulnerable to unauthenticated SSRF via Azure Instance Identity Endpoint

Coder allows organizations to provision remote development environments via Terraform. Versions prior tp 2.24.5, 2.29.13, 2.30.8, 2.31.12, 2.32.2, and 2.33.3 are vulnerable to unauthenticated semi-blind Server-Side Request Forgery SSRF via the Azure instance identity endpoint POST...

CVE-2026-45796

Coder allows organizations to provision remote development environments via Terraform. Versions prior tp 2.24.5, 2.29.13, 2.30.8, 2.31.12, 2.32.2, and 2.33.3 are vulnerable to unauthenticated semi-blind Server-Side Request Forgery SSRF via the Azure instance identity endpoint POST...

CVE-2026-45796

Summary of CVE-2026-45796 : Coder versions prior to 2.33.3 (and older releases in the 2.32.2, 2.31.12, 2.30.8, 2.29.13, and 2.24.5 lines) are vulnerable to an unauthenticated semi-blind SSRF via the Azure Instance Identity Endpoint at POST /api/v2/workspaceagents/azure-instance-identity. An attac...

PYSEC-2026-1208 Azure Core is vulnerable to deserialization of untrusted data

Deserialization of untrusted data in Azure Core shared client library for Python allows an authorized attacker to execute code over a network...