Raw vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:HSummary
CVE-2026-55427 is a high-severity Injection (CWE-74) vulnerability in Coder Coder. Its CVSS base score is 8.3 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Private Keys (T1552.004); ranked at the 19th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) and SC-18 (Mobile Code) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-42133
Vulnerability Data
Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, `coder config-ssh` wrote server-supplied SSH settings (`HostnameSuffix`, `SSHConfigOptions`) into the user's `~/.ssh/config` without sanitizing embedded newlines or restricting directives so a malicious…
more
or compromised Coder server could inject arbitrary SSH configuration. Practical exploitation requires control of the server-supplied values through a malicious or compromised deployment, a man-in-the-middle position or admin access to the `HostnameSuffix` and `SSHConfigOptions` settings. The fix in versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2 validates `HostnameSuffix` and `SSHConfigOptions` against a strict character set that rejects newlines and other control characters. As a workaround, inspect `coder config-ssh --dry-run` output before applying changes.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE-2026-55427 allows a compromised Coder server to inject arbitrary SSH configuration directives (including Host/Hostname, ProxyCommand, etc.) into the user's ~/.ssh/config via unsanitized HostnameSuffix/SSHConfigOptions. This directly enables T1552.004 (Private Keys) by directing SSH to attacker-controlled hosts or proxies that could exfiltrate keys, and T1574.009 (Path Interception by Unquoted Path) or similar hijacking via malicious ProxyCommand or similar directives. No other ATT&CK techniques are directly enabled by the vulnerability description.
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Enforces validation of untrusted server-supplied values (HostnameSuffix, SSHConfigOptions) before they are written into ~/.ssh/config, directly blocking newline/control-character injection.
Restricts the use and execution of mobile or downloaded code (the generated SSH config) that could contain attacker-controlled directives.
Limits the functionality of the SSH client configuration to only approved directives, reducing the attack surface for injected options.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require input validation and output encoding that prevent injection flaws.
Routine patching/maintenance can remediate known command-injection CVEs in dependencies (partial forward) but does nothing to stop developers from introducing improper neutralization in custom code (none reverse).
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development catches injection vulnerabilities before release.
Logging supports detection of injection attempts but does not prevent the weakness.
Monitoring activities can identify active injection attacks after they occur.
Secure development life cycle mandates input validation and output encoding that directly prevent injection flaws.
Application security requirements explicitly call for controls against injection attacks in software design.
Secure architecture principles reduce injection surfaces but do not prescribe specific neutralization techniques.