8.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-55427

CVE-2026-55427: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh`

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, coder config-ssh wrote server-supplied SSH settings (HostnameSuffix, SSHConfigOptions) into the user's ~/.ssh/config without sanitizing embedded newlines or restricting directives so a malicious or compromised Coder server could inject arbitrary SSH configuration. Practical exploitation requires control of the server-supplied values through a malicious or compromised deployment, a man-in-the-middle position or admin access to the HostnameSuffix and SSHConfigOptions settings. The fix in versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2 validates HostnameSuffix and SSHConfigOptions against a strict character set that rejects newlines and other control characters. As a workaround, inspect coder config-ssh --dry-run output before applying changes.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-55427

CVE-2026-55427:

8.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Total

Select your environment

→SSVCScheduled60 days

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/coder/coder/v2	go	>= 2.34.0, < 2.34.2	2.34.2
github.com/coder/coder/v2	go	>= 2.33.0, < 2.33.8	2.33.8
github.com/coder/coder/v2	go	>= 2.30.0, < 2.32.7	2.32.7
github.com/coder/coder/v2	go	< 2.29.17	2.29.17

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the coder config-ssh command, which writes server-supplied SSH settings to the user's ~/.ssh/config file without proper sanitization. This could allow a malicious or compromised Coder server to inject arbitrary SSH configuration, leading to remote code execution on the developer's machine.

The analysis of the patch reveals that the core of the vulnerability was the lack of input validation for the HostnameSuffix and SSHConfigOptions settings. The patch introduces validation at both the client and server sides.

On the client side, the cli.mergeSSHOptions function in cli/configssh.go is the primary vulnerable function. It is responsible for merging the server-supplied configuration with the user's local configuration. Before the patch, it directly used the values from the server without any validation. The patch adds calls to new validation functions (codersdk.ValidateWorkspaceHostnameSuffix, codersdk.ValidateSSHConfigOptions, etc.) at the beginning of this function.

On the server side, the cli.RootCmd.Server function in cli/server.go was also involved. It allowed the server to be configured with malicious SSH options that would then be sent to clients. The patch adds validation at server startup to prevent this from happening.

The codersdk.ParseSSHConfigOption function was also identified as vulnerable because it didn't properly sanitize the input, allowing newline characters that could be used to inject new SSH directives.

Therefore, during exploitation, a stack trace would likely show cli.mergeSSHOptions being called by the coder config-ssh command, processing the malicious configuration received from the server.

Vulnerable functions

cli.mergeSSHOptions

cli/configssh.go

This function is responsible for merging server-supplied SSH configuration (`HostnameSuffix`, `SSHConfigOptions`) into the user's local SSH configuration. Prior to the patch, it did not sanitize or validate these values, allowing a malicious server to inject arbitrary SSH configuration directives, leading to remote code execution on the client machine when `coder config-ssh` is executed.

codersdk.ParseSSHConfigOption

codersdk/deployment.go

This function parses a single SSH config option. Before the patch, it did not check for newlines or other control characters, which allowed for the injection of additional SSH config directives. This function is called by the server and client components when processing SSH options.

cli.RootCmd.Server

cli/server.go

This function starts the Coder server. The patch adds validation for the SSH configuration options provided to the server at startup. A malicious administrator or an attacker with control over the server's configuration could set malicious `HostnameSuffix` or `SSHConfigOptions` values, which would then be served to clients, leading to the vulnerability on the client side. This function was vulnerable as it allowed the server to start with a malicious configuration.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.