CVE-2026-55427: Coder SSH Config Injection Vulnerability (CVSS 8.3)

Technical summary

The vulnerability exists in how `coder config-ssh` handles the `HostnameSuffix` and `SSHConfigOptions` parameters received from the Coder server. These values are written directly into `~/.ssh/config` without sanitization of newline characters or validation of SSH directive syntax. An attacker with control over server-supplied values can inject newlines to create new SSH configuration directives, potentially including `ProxyCommand` or other commands that execute during SSH operations. The underlying issue is improper input validation (CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component) combined with OS command injection implications (CWE-78). The patches implement strict character-set validation that rejects control characters and newlines in both fields.

Business impact

For organizations using Coder, this vulnerability creates a supply-chain-like risk: a single compromised or malicious Coder deployment affects all connected developers. An attacker gaining administrative access to Coder settings or successfully compromising the Coder server could execute arbitrary commands on developer machines when those developers use SSH. This could result in theft of credentials, source code, private keys, or lateral movement into the development network or internal systems. The blast radius is particularly concerning because developers often have elevated privileges and access to sensitive systems.

Affected systems

Coder versions before 2.29.7, 2.32.7, 2.33.8, and 2.34.2 are vulnerable. Organizations should identify which version is deployed and cross-reference against the patched versions. Users of older release branches that do not have a corresponding patched version listed should contact Coder for guidance or migrate to a supported branch.

Exploitability

Exploitation is rated HIGH in impact but requires specific prerequisites: an attacker must control the Coder server (through compromise or malicious intent), have administrative access to the `HostnameSuffix` and `SSHConfigOptions` settings, or be positioned to perform a man-in-the-middle attack on communications between the developer and server. Remote unauthenticated exploitation is not possible. However, once those conditions are met, the attack is straightforward and highly effective, requiring only configuration changes rather than complex payload development. The user interaction requirement—developers must run `coder config-ssh`—is typical for this type of configuration tool.

Remediation

Upgrade Coder to version 2.29.7, 2.32.7, 2.33.8, or 2.34.2, depending on your current branch. As an interim workaround, administrators and developers can use `coder config-ssh --dry-run` to preview the SSH configuration changes before they are applied to `~/.ssh/config`, allowing manual inspection for suspicious directives. This does not fix the vulnerability but reduces the risk of silent injection.

Patch guidance

Apply the latest patch version corresponding to your current Coder release branch: 2.29.7 for the 2.29 series, 2.32.7 for 2.32, 2.33.8 for 2.33, or 2.34.2 for 2.34. Verify the patch version in the release notes and test in a non-production environment before rolling out broadly. After patching, the SSH configuration validation will reject any attempts to inject control characters or newlines via server-supplied settings.

Detection guidance

Monitor for anomalous SSH configuration in developers' `~/.ssh/config` files—specifically look for unexpected directives like `ProxyCommand`, `LocalForward`, or `RemoteForward` that do not match organizational standards. Audit Coder server logs for any modifications to `HostnameSuffix` or `SSHConfigOptions` settings, particularly by non-administrative accounts. If you suspect compromise, compare `~/.ssh/config` across developer machines against a baseline; unusual entries may indicate injection attempts. Consider implementing file integrity monitoring on critical SSH configuration locations.

Why prioritize this

This vulnerability scores 8.3 (HIGH CVSS) due to the potential for remote code execution on developer machines combined with high impact (confidentiality, integrity, and availability are all at risk). Although exploitation requires server-side compromise or specific prerequisites, the scope is cross-cutting (affects all developers using a compromised Coder instance) and the consequences are severe. Any organization relying on Coder for infrastructure should prioritize patching promptly to eliminate this post-compromise attack vector.

Risk score, explained

The CVSS 3.1 score of 8.3 reflects: (1) Network-accessible attack vector and high attack complexity (prerequisites required), (2) no privilege escalation needed from the Coder user perspective, (3) required user interaction (running the config-ssh command), (4) changed scope (impacts developer machines beyond the Coder server itself), and (5) high impact across all three security pillars—confidentiality (data theft), integrity (code modification), and availability (system compromise or disruption). The HIGH severity appropriately balances the serious consequences against the prerequisite requirements.

Frequently asked questions