{"id":"CVE-2026-55427","aliases":["GHSA-mcqq-fqgf-rxwm"],"title":"Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh`","summary":"Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh`","severity":"high","cvss":8.3,"cwe":["CWE-74","CWE-78"],"vendor":"coder","product":"github.com/coder/coder/v2","ecosystem":"go","affected":["github.com/coder/coder/v2 >= 2.34.0, < 2.34.2","github.com/coder/coder/v2 >= 2.33.0, < 2.33.8","github.com/coder/coder/v2 >= 2.30.0, < 2.32.7","github.com/coder/coder/v2 < 2.29.17"],"patched":["github.com/coder/coder/v2 2.34.2","github.com/coder/coder/v2 2.33.8","github.com/coder/coder/v2 2.32.7","github.com/coder/coder/v2 2.29.17"],"published":"2026-07-06","updated":"2026-07-06","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-mcqq-fqgf-rxwm","references":[{"url":"https://github.com/coder/coder/security/advisories/GHSA-mcqq-fqgf-rxwm"},{"url":"https://github.com/coder/coder/pull/26154"},{"url":"https://github.com/advisories/GHSA-mcqq-fqgf-rxwm"}],"tags":["ghsa","go"],"ingestedAt":"2026-07-06T21:45:52.972Z","epss":0.00466,"epssPercentile":0.39467,"slug":"CVE-2026-55427","body":"## Overview\n\n### Summary\n\n`coder config-ssh` wrote server-supplied SSH settings (`HostnameSuffix`, `SSHConfigOptions`) into the user's `~/.ssh/config` without sanitizing embedded newlines or restricting directives so a malicious or compromised Coder server could inject arbitrary SSH configuration.\n\n> **Note:** Practical exploitation requires control of the server-supplied values through a malicious or compromised deployment, a man-in-the-middle position or admin access to the `HostnameSuffix` and `SSHConfigOptions` settings.\n\n### Impact\n\nA server administrator or an attacker who controlled the server, could inject a directive such as `ProxyCommand` and achieve arbitrary code execution on any developer workstation that ran `coder config-ssh`. Injected commands ran with the local user's privileges and applied to all SSH connections, not just Coder workspaces.\n\n### Patches\n\nThe fix validates `HostnameSuffix` and `SSHConfigOptions` against a strict character set that rejects newlines and other control characters.\n\nThe fix was backported to all supported release lines:\n\n| Release line | Patched version |\n|---|---|\n| 2.34 | [v2.34.2](https://github.com/coder/coder/releases/tag/v2.34.2) |\n| 2.33 | [v2.33.8](https://github.com/coder/coder/releases/tag/v2.33.8) |\n| 2.32 | [v2.32.7](https://github.com/coder/coder/releases/tag/v2.32.7) |\n| 2.29 (ESR) | [v2.29.17](https://github.com/coder/coder/releases/tag/v2.29.17) |\n\n### Workarounds\n\nInspect `coder config-ssh --dry-run` output before applying changes.\n\n### Resources\n\n- Fix: #26154\n\n### Credits\n\nCoder would like to thank Anthropic's Security Team (ANT-2026-22437) for independently disclosing this issue!\n\n## Affected packages\n\n- `github.com/coder/coder/v2 >= 2.34.0, < 2.34.2`\n- `github.com/coder/coder/v2 >= 2.33.0, < 2.33.8`\n- `github.com/coder/coder/v2 >= 2.30.0, < 2.32.7`\n- `github.com/coder/coder/v2 < 2.29.17`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `github.com/coder/coder/v2 2.34.2`\n- `github.com/coder/coder/v2 2.33.8`\n- `github.com/coder/coder/v2 2.32.7`\n- `github.com/coder/coder/v2 2.29.17`","depth":"twilight","depthScore":46,"depthScoreParts":{"impact":45.7,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}