CVE-2026-55427

highpriority · track · 0EPSS 0.005 · 40 %ileEUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

0.47% (40th) EPSS

CVSS 8.3 · high

Is it mine?

13 products

Check your exposure

Who says so?

4 sources

cnnvd · enisa_euvd · osv · nvd

EPSS · scored 2026-10-27

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, `coder config-ssh` wrote server-supplied SSH settings (`HostnameSuffix`, `SSHConfigOptions`) into the user's `~/.ssh/config` without sanitizing embedded newlines or restricting directives so a malicious or compromised Coder server could inject arbitrary SSH configuration. Practical exploitation requires control of the server-supplied values through a malicious or compromised deployment, a man-in-the-middle position or admin access to the `HostnameSuffix` and `SSHConfigOptions` settings. The fix in versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2 validates `HostnameSuffix` and `SSHConfigOptions` against a strict character set that rejects newlines and other control characters. As a workaround, inspect `coder config-ssh --dry-run` output before applying changes.

cvss

Technical severity, 0–10. One row per scoring source.

8.3

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.18.3highCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:Hsecondary · ENISA EU

v3.18.3highCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:Hsecondary · security-advisories@github.comexploitability 1.6 · impact 6

v3.18.3highCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:Hsecondary · OSV

v3.17.6highCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-74USCWE-74USCWE-78USCWE-78US

affected products (13)

Products and version ranges known to be affected.

coder coder≤ < 2.29.17enisa_euvdEU
coder coder2.30.0, → 2.32.7enisa_euvdEU
coder coder2.33.0, → 2.33.8enisa_euvdEU
coder coder2.34.0, → 2.34.2enisa_euvdEU
coder coder< 2.29.17nvdUScpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*
coder coder2.30.0 → 2.32.7nvdUScpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*
coder coder2.33.0 → 2.33.8nvdUScpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*
coder coder2.34.0 → 2.34.2nvdUScpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*
Go github.com/coder/coderall versionsosvUSpkg:golang/github.com/coder/coder
Go github.com/coder/coder/v2< 2.29.17osvUSpkg:golang/github.com/coder/coder/v2
Go github.com/coder/coder/v22.30.0 → 2.32.7osvUSpkg:golang/github.com/coder/coder/v2
Go github.com/coder/coder/v22.33.0 → 2.33.8osvUSpkg:golang/github.com/coder/coder/v2
Go github.com/coder/coder/v22.34.0 → 2.34.2osvUSpkg:golang/github.com/coder/coder/v2

advisories (2)

Vendor and ecosystem advisories describing this.

GHSA-mcqq-fqgf-rxwmCoder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh`2026-07-06ghsa · osvUS
### Summary `coder config-ssh` wrote server-supplied SSH settings (`HostnameSuffix`, `SSHConfigOptions`) into the user's `~/.ssh/config` without sanitizing embedded newlines or restricting directives so a malicious or compromised Coder server could inject arbitrary SSH configuration. > **Note:** Practical exploitation requires control of the server-supplied values through a malicious or compromised deployment, a man-in-the-middle position or admin access to the `HostnameSuffix` and `SSHConfigOptions` settings. ### Impact A server administrator or an attacker who controlled the server, could inject a directive such as `ProxyCommand` and achieve arbitrary code execution on any developer workstation that ran `coder config-ssh`. Injected commands ran with the local user's privileges and applied to all SSH connections, not just Coder workspaces. ### Patches The fix validates `HostnameSuffix` and `SSHConfigOptions` against a strict character set that rejects newlines and other control characters. The fix was backported to all supported release lines: | Release line | Patched version | |---|---| | 2.34 | [v2.34.2](https://github.com/coder/coder/releases/tag/v2.34.2) | | 2.33 | [v2.33.8](https://github.com/coder/coder/releases/tag/v2.33.8) | | 2.32 | [v2.32.7](https://github.com/coder/coder/releases/tag/v2.32.7) | | 2.29 (ESR) | [v2.29.17](https://github.com/coder/coder/releases/tag/v2.29.17) | ### Workarounds Inspect `coder config-ssh --dry-run` output before applying changes. ### Resources - Fix: #26154 ### Credits Coder would like to thank Anthropic's Security Team (ANT-2026-22437) for independently disclosing this issue!
GO-2026-5913Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder2026-07-07vendor · osvUS
Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` in github.com/coder/coder

also known as (5)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd osv nvd NVD CVE.org MITRE

published 2026-07-08modified 2026-07-08

references (19)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan