Summary
azureidentity.Validate() verifies that the PKCS#7 signer certificate chains to a trusted Azure CA but never verifies the PKCS#7 signature itself. An attacker can embed a legitimate Azure certificate alongside arbitrary content e.g. {"vmId":"<target>"} and the forged vmId will be accepted returning the victim workspace agent's session token.
No authentication is required. The attacker only needs to know a target VM's vmId which is a UUIDv4.
that's a practical limitation which would typically require prior access to be exploited
Root Cause
In unpatched Coder releases the signature over the PKCS#7 content is not validated - only the signing certificate is checked.
Impact
An attacker on any Azure VM or with access to a publicly available Azure IMDS certificate from CT logs can:
- Steal an agent session token by sending a forged PKCS#7 envelope to
POST /api/v2/workspaceagents/azure-instance-identity which is unauthenticated.
- With the stolen token access:
- Git SSH private key via
GET /workspaceagents/me/gitsshkey: push to repositories and impersonate the workspace owner.
- OAuth access tokens via
GET /workspaceagents/me/external-auth: GitHub, GitLab, and Bitbucket tokens in plaintext.
- Workspace secrets via the agent manifest: environment variables, file paths, and API keys.
Attack Path Diagram
Affected Versions
All versions of Coder v2 are affected.
Patches
Fixed in #25286
The fix was backported to all supported release lines:
Workarounds
If unable to patch we recommend immediately reconfiguring any Azure templates to use token authentication rather than azure-instance-identity until the patch is released and you are fully upgraded.
- Modify the
coder_agent.auth value to be token.
- Add
CODER_AGENT_TOKEN=${coder_agent.main.token} to the set of environment variables for the Coder Workspace Agent initialization script.
Recognition
We'd like to thank Ben Tran of calif.io and Anthropic’s Security Team (ANT-2026-22445) for independently disclosing this issue!
References
bencalif Reporter
Summary
azureidentity.Validate()verifies that the PKCS#7 signer certificate chains to a trusted Azure CA but never verifies the PKCS#7 signature itself. An attacker can embed a legitimate Azure certificate alongside arbitrary content e.g.{"vmId":"<target>"}and the forgedvmIdwill be accepted returning the victim workspace agent's session token.No authentication is required. The attacker only needs to know a target VM's
vmIdwhich is aUUIDv4.Root Cause
In unpatched Coder releases the signature over the PKCS#7 content is not validated - only the signing certificate is checked.
Impact
An attacker on any Azure VM or with access to a publicly available Azure IMDS certificate from CT logs can:
POST /api/v2/workspaceagents/azure-instance-identitywhich is unauthenticated.GET /workspaceagents/me/gitsshkey: push to repositories and impersonate the workspace owner.GET /workspaceagents/me/external-auth: GitHub, GitLab, and Bitbucket tokens in plaintext.Attack Path Diagram
Affected Versions
All versions of Coder v2 are affected.
Patches
Fixed in #25286
The fix was backported to all supported release lines:
Workarounds
If unable to patch we recommend immediately reconfiguring any Azure templates to use token authentication rather than
azure-instance-identityuntil the patch is released and you are fully upgraded.coder_agent.authvalue to betoken.CODER_AGENT_TOKEN=${coder_agent.main.token}to the set of environment variables for the Coder Workspace Agent initialization script.Recognition
We'd like to thank Ben Tran of calif.io and Anthropic’s Security Team (
ANT-2026-22445) for independently disclosing this issue!References