Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft
Date: 2026-05
Affected: go/github.com/coder/coder, go/github.com/coder/coder/v2, go/github.com/coder/coder/v2
Attack vector: deepfake
Category: vulnerability-disclosure
Severity: Critical
CVE: CVE-2026-45796
CVE-2026-46354
CWE: CWE-347
CWE-918
CVSS: 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)

## Summary `azureidentity.Validate()` verifies that the PKCS#7 signer certificate chains to a trusted Azure CA but never verifies the PKCS#7 signature itself. An attacker can embed a legitimate Azure certificate alongside arbitrary content e.g. `{"vmId":"<target>"}` and the forged `vmId` will be accepted returning the victim workspace agent's session token. **No authentication is required.** The attacker only needs to know a target VM's `vmId` which is a `UUIDv4`. > that's a practical limitation which would typically require prior access to be exploited ## Root Cause In unpatched Coder releases the signature over the PKCS#7 content is not validated - only the signing certificate is checked. ## Impact An attacker on any Azure VM or with access to a publicly available Azure IMDS certificate from CT logs can: 1. **Steal an agent session token** by sending a forged PKCS#7 envelope to `POST /api/v2/workspaceagents/azure-instance-identity` which is unauthenticated. 2. **With the stolen token** access: - **Git SSH private key** via `GET /workspaceagents/me/gitsshkey`: push to repositories and impersonate the workspace owner. - **OAuth access tokens** via `GET /workspaceagents/me/external-auth`: GitHub, GitLab, and Bitbucket tokens in plaintext. - **Workspace secrets** via the agent manifest: environment variables, file paths, and API keys. ## Attack Path Diagram <img width="5588" height="4176" alt="PKCS7_diagram (1)" src="https://github.com/user-attachments/assets/


Mitigations:

Architectural layers (MAESTRO):