CVE-2026-55427: coder Injection
Vulnerability summary
CVE-2026-55427 is a high (CVSS 8.3) Injection vulnerability in coder. EPSS estimates a 0.47% chance of exploitation in the next 30 days, higher than 39% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 1 · Related 1Timeline
- 07-07-2026PublishedVulnerability first disclosed.
- 08-07-2026Last modifiedVulnerability information updated.
Description
Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, `coder config-ssh` wrote server-supplied SSH settings (`HostnameSuffix`, `SSHConfigOptions`) into the user's `~/.ssh/config` without sanitizing embedded newlines or restricting directives so a malicious or compromised Coder server could inject arbitrary SSH configuration. Practical exploitation requires control of the server-supplied values through a malicious or compromised deployment, a man-in-the-middle position or admin access to the `HostnameSuffix` and `SSHConfigOptions` settings. The fix in versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2 validates `HostnameSuffix` and `SSHConfigOptions` against a strict character set that rejects newlines and other control characters. As a workaround, inspect `coder config-ssh --dry-run` output before applying changes.
CVSS metrics
3 scores · 3 sources · 1 version- OSV · GoEcosystem advisory · calculated8.3HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
- NVDNIST8.3HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
EPSS trend
Probability
0.47%
Chance of exploitation in the next 30 days
Percentile
39%
Versus all other CVEs
30-day change
0.00 pp
From 0.47% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-74Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
- CWE-78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
Affected systems
Coder1 product
- coder< 2.29.17 | ≥ 2.30.0, < 2.32.7 | ≥ 2.33.0, < 2.33.8 | ≥ 2.34.0, < 2.34.2
Github.com/coder1 product
- coderAll versions (No fix recorded)
Github.com/coder/coder1 product
- v2≥ 2.33.0, < 2.33.8 | ≥ 2.30.0, < 2.32.7 | < 2.29.17 | ≥ 2.34.0, < 2.34.2
3 vendors · 3 products
References
7 links- github.com/coder/coder/security/advisories/GHSA-mcqq-fqgf-rxwmX Refsource CONFIRMWEBAdvisoryPatchVendor Advisory
- github.com/coder/coderPACKAGE