Is CVE-2026-45796 actively exploited?

No active exploitation of CVE-2026-45796 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-45796 be exploited remotely?

Yes. CVE-2026-45796 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-45796?

CVE-2026-45796 has a CVSS score of 6.5 (MEDIUM).

HOME VULNERABILITIESCVE-2026-45796

MEDIUM

CVE-2026-45796

CWE-918Published: July 7, 2026· Updated: Jul 8, 2026

6.5

CVSS v3.1

EPSS:0.34%probability of exploitation in 30 daysPercentile:25.5th

Official Description

Coder allows organizations to provision remote development environments via Terraform. Versions prior tp 2.24.5, 2.29.13, 2.30.8, 2.31.12, 2.32.2, and 2.33.3 are vulnerable to unauthenticated semi-blind Server-Side Request Forgery (SSRF) via the Azure instance identity endpoint (`POST /api/v2/workspaceagents/azure-instance-identity`). An external attacker can force the Coder server to issue HTTP GET requests to arbitrary internal or external hosts by submitting a crafted PKCS#7 signature. The server does not return the target's response body, but error messages in the API response reveal whether the target is reachable and what type of failure occurred. Versions 2.24.5, 2.29.13, 2.30.8, 2.31.12, 2.32.2, and 2.33.3 patch the issue. As a workaround, if the Azure identity-auth mechanism is not being used then restrict access to the corresponding endpoint (`/api/v2/workspaceagents/azure-instance-identity`) using ingress firewall and/or proxy ACLs.

NVD Source

Technical Analysis

CVE-2026-45796 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.