Cyber Resilience

CVE-2026-55427

RCE in Coder ≤ 2.29.17

Published
08 July 2026
Modified
08 July 2026
Patch / advisory
CVSS Score v3.1 8.3
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
EPSS Score 0.0027 19th percentile
Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2026-55427 is a high-severity Injection (CWE-74) vulnerability in Coder Coder. Its CVSS base score is 8.3 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Private Keys (T1552.004); ranked at the 19th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) and SC-18 (Mobile Code) — see the control section below for these in your framework.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability Data

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, `coder config-ssh` wrote server-supplied SSH settings (`HostnameSuffix`, `SSHConfigOptions`) into the user's `~/.ssh/config` without sanitizing embedded newlines or restricting directives so a malicious…

more

or compromised Coder server could inject arbitrary SSH configuration. Practical exploitation requires control of the server-supplied values through a malicious or compromised deployment, a man-in-the-middle position or admin access to the `HostnameSuffix` and `SSHConfigOptions` settings. The fix in versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2 validates `HostnameSuffix` and `SSHConfigOptions` against a strict character set that rejects newlines and other control characters. As a workaround, inspect `coder config-ssh --dry-run` output before applying changes.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1552.004 Private Keys Credential Access
Adversaries may search for private key certificate files on compromised systems for insecurely stored credentials.
T1574.009 Path Interception by Unquoted Path Stealth
Adversaries may execute their own malicious payloads by hijacking vulnerable file path references.
Why these techniques?

CVE-2026-55427 allows a compromised Coder server to inject arbitrary SSH configuration directives (including Host/Hostname, ProxyCommand, etc.) into the user's ~/.ssh/config via unsanitized HostnameSuffix/SSHConfigOptions. This directly enables T1552.004 (Private Keys) by directing SSH to attacker-controlled hosts or proxies that could exfiltrate keys, and T1574.009 (Path Interception by Unquoted Path) or similar hijacking via malicious ProxyCommand or similar directives. No other ATT&CK techniques are directly enabled by the vulnerability description.

Confidence: MEDIUM · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2024-49380Shared CWE-74, CWE-78
CVE-2023-31209Shared CWE-74, CWE-78
CVE-2023-35895Shared CWE-74, CWE-78
CVE-2024-10919Shared CWE-74, CWE-78
CVE-2021-38294Shared CWE-74, CWE-78
CVE-2025-13306Shared CWE-74, CWE-78
CVE-2025-0528Shared CWE-74, CWE-78
CVE-2026-5101Shared CWE-74, CWE-78
CVE-2024-10914Shared CWE-74, CWE-78
CVE-2024-10915Shared CWE-74, CWE-78

Affected Assets

coder
coder
≤ 2.29.17 · 2.30.0 — 2.32.7 · 2.33.0 — 2.33.8

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
  • SI-10 Information Input Validation
  • SC-18 Mobile Code
  • CM-7 Least Functionality
Detect
Catch it (NIST detect / respond)

Harden
Shrink the surface (DISA STIG)

Validate
Prove the fix (OWASP ASVS)
  • V1.2.1
  • V1.2.3
  • V1.2.5
  • V1.2.8

Mitigating Controls (NIST 800-53 r5) AI

prevent

Enforces validation of untrusted server-supplied values (HostnameSuffix, SSHConfigOptions) before they are written into ~/.ssh/config, directly blocking newline/control-character injection.

SC-18 Mobile Code partial match
prevent

Restricts the use and execution of mobile or downloaded code (the generated SSH config) that could contain attacker-controlled directives.

prevent

Limits the functionality of the SSH client configuration to only approved directives, reducing the attack surface for injected options.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices directly require input validation and output encoding that prevent injection flaws.

PR.PS-02 partial match
prevents

Routine patching/maintenance can remediate known command-injection CVEs in dependencies (partial forward) but does nothing to stop developers from introducing improper neutralization in custom code (none reverse).

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

detects

Security testing in development catches injection vulnerabilities before release.

A.8.15 Logging partial match
detects

Logging supports detection of injection attempts but does not prevent the weakness.

detects

Monitoring activities can identify active injection attacks after they occur.

prevents

Secure development life cycle mandates input validation and output encoding that directly prevent injection flaws.

prevents

Application security requirements explicitly call for controls against injection attacks in software design.

prevents

Secure architecture principles reduce injection surfaces but do not prescribe specific neutralization techniques.

References