CVE-2026-55427: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh`
Summary
coder config-ssh wrote server-supplied SSH settings (HostnameSuffix, SSHConfigOptions) into the user's ~/.ssh/config without sanitizing embedded newlines or restricting directives so a malicious or compromised Coder server could inject arbitrary SSH configuration.
Note: Practical exploitation requires control of the server-supplied values through a malicious or compromised deployment, a man-in-the-middle position or admin access to the HostnameSuffix and SSHConfigOptions settings.
Impact
A server administrator or an attacker who controlled the server, could inject a directive such as ProxyCommand and achieve arbitrary code execution on any developer workstation that ran coder config-ssh. Injected commands ran with the local user's privileges and applied to all SSH connections, not just Coder workspaces.
Patches
The fix validates HostnameSuffix and SSHConfigOptions against a strict character set that rejects newlines and other control characters.
The fix was backported to all supported release lines:
| Release line | Patched version | |---|---| | 2.34 | v2.34.2 | | 2.33 | v2.33.8 | | 2.32 | v2.32.7 | | 2.29 (ESR) | v2.29.17 |
Workarounds
Inspect coder config-ssh --dry-run output before applying changes.
Resources
- Fix: #26154
Credits
Coder would like to thank Anthropic's Security Team (ANT-2026-22437) for independently disclosing this issue!
Other sources
Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, coder config-ssh wrote server-supplied SSH settings (HostnameSuffix, SSHConfigOptions) into the user's ~/.ssh/config without sanitizing embedded newlines or restricting directives so a malicious or compromised Coder server could inject arbitrary SSH configuration. Practical exploitation requires control of the server-supplied values through a malicious or compromised deployment, a man-in-the-middle position or admin access to the HostnameSuffix and SSHConfigOptions settings. The fix in versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2 validates HostnameSuffix and SSHConfigOptions against a strict character set that rejects newlines and other control characters. As a workaround, inspect coder config-ssh --dry-run output before applying changes.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/coder/coder/v2to a version that resolves this vulnerability.Fixed in 2.29.17 - Upgrade
Upgrade
go/github.com/coder/coder/v2to a version that resolves this vulnerability.Fixed in 2.32.7 - Upgrade
Upgrade
go/github.com/coder/coder/v2to a version that resolves this vulnerability.Fixed in 2.33.8 - Upgrade
Upgrade
go/github.com/coder/coder/v2to a version that resolves this vulnerability.Fixed in 2.34.2 - Upgrade
Upgrade
coderto a version that resolves this vulnerability.Fixed in 2.29.7 - Upgrade
Upgrade
coderto a version that resolves this vulnerability.Fixed in 2.32.7 - Upgrade
Upgrade
coderto a version that resolves this vulnerability.Fixed in 2.33.8 - Upgrade
Upgrade
coderto a version that resolves this vulnerability.Fixed in 2.34.2 - Operational
As a workaround before applying changes, inspect the output of `coder config-ssh --dry-run` before applying changes to ensure no injected SSH directives (e.g., `ProxyCommand`) are present.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-55427?
CVE-2026-55427 has a severity rating of high at 8.3.
How do I fix CVE-2026-55427?
To fix CVE-2026-55427, ensure that you apply the latest patches provided by Coder and sanitize inputs to the SSH configuration.
What are the potential impacts of CVE-2026-55427?
The potential impacts of CVE-2026-55427 include unauthorized SSH configuration modifications due to server-supplied values being injected.
Who is affected by CVE-2026-55427?
Users of Coder who rely on the `coder config-ssh` command without adequately secured server configurations are affected by CVE-2026-55427.
What type of vulnerability is CVE-2026-55427 classified as?
CVE-2026-55427 is classified as an OS Command Injection vulnerability.