https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 03:45:17 +0000 https://cve.radiocsirt.org/vuln/cve-2026-46354 <p><strong>Affected:</strong> coder</p> <p>Coder allows organizations to provision remote development environments via Terraform. In versions prior tp 2.24.5, 2.29.13, 2.30.8, 2.31.12, 2.32.2, and 2.33.3, `azureidentity.Validate()` verifies that the PKCS#7 signer certificate chains to a trusted Azure CA but never verifies the PKCS#7 signature itself. An attacker can embed a legitimate Azure certificate alongside arbitrary content e.g. `{&#34;vmId&#34;:&#34;&lt;target&gt;&#34;}` and the forged `vmId` will be accepted returning the victim workspace agent&#39;s session token. No authentication is required. The attacker only needs to know a target VM&#39;s `vmId` which is a `UUIDv4`. That&#39;s a practical limitation which would typically require prior access to be exploited. Versions 2.24.5, 2.29.13, 2.30.8, 2.31.12, 2.32.2, and 2.33.3 patch the issue. As a workaround, reconfigure any Azure templates to use token authentication rather than `azure-instance-identity`.</p> <p><strong>Affected:</strong> coder</p> <p>Coder allows organizations to provision remote development environments via Terraform. In versions prior tp 2.24.5, 2.29.13, 2.30.8, 2.31.12, 2.32.2, and 2.33.3, `azureidentity.Validate()` verifies that the PKCS#7 signer certificate chains to a trusted Azure CA but never verifies the PKCS#7 signature itself. An attacker can embed a legitimate Azure certificate alongside arbitrary content e.g. `{&#34;vmId&#34;:&#34;&lt;target&gt;&#34;}` and the forged `vmId` will be accepted returning the victim workspace agent&#39;s session token. No authentication is required. The attacker only needs to know a target VM&#39;s `vmId` which is a `UUIDv4`. That&#39;s a practical limitation which would typically require prior access to be exploited. Versions 2.24.5, 2.29.13, 2.30.8, 2.31.12, 2.32.2, and 2.33.3 patch the issue. As a workaround, reconfigure any Azure templates to use token authentication rather than `azure-instance-identity`.</p> https://cve.radiocsirt.org/vuln/cve-2026-46354