V2: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` (CVE-2026-55427)
### Summary `coder config-ssh` wrote server-supplied SSH settings (`HostnameSuffix`, `SSHConfigOptions`) into the user's `~/.ssh/config` without sanitizing embedded newlines or restricting directives so a malicious or compromised Coder server could inject arbitrary SSH configuration. > **Note:** Practical exploitation requires control of the server-supplied values through a malicious or compromised deployment, a man-in-the-middle position or admin access to the `HostnameSuffix` and `SSHConfigOptions` settings. ### Impact A server administrator or an attacker who controlled the server, could inject a directive such as `ProxyCommand` and achieve arbitrary code execution on any developer workstation that ran `coder config-ssh`. Injected commands ran with the local user's privileges and applied to all SSH connections, not just Coder workspaces. ### Patches The fix validates `HostnameSuffix` and `SSHConfigOptions` against a strict character set that rejects newlines and other control characters. The fix was backported to all supported release lines: | Release line | Patched version | |---|---| | 2.34 | [v2.34.2](https://github.com/coder/coder/releases/tag/v2.34.2) | | 2.33 | [v2.33.8](https://github.com/coder/coder/releases/tag/v2.33.8) | | 2.32 | [v2.32.7](https://github.com/coder/coder/releases/tag/v2.32.7) | | 2.29 (ESR) | [v2.29.17](https://github.com/coder/coder/releases/tag/v2.29.17) | ### Workarounds Inspect `coder config-ssh --dry-run` output before applying changes. ### Resources - Fix: #26154 ### Credits Coder would like to thank Anthropic's Security Team (ANT-2026-22437) for independently disclosing this issue!
AI Analysis
Technical Summary
Coder's `config-ssh` command previously wrote server-supplied SSH settings (`HostnameSuffix`, `SSHConfigOptions`) directly into the user's SSH configuration file without sanitization. This allowed a malicious or compromised server to inject arbitrary SSH configuration directives, including those enabling arbitrary code execution (e.g., via `ProxyCommand`). Exploitation requires control over server-supplied values, such as through a compromised server or administrative access. The vulnerability is tracked as CVE-2026-55427 and has been patched in versions 2.34.2, 2.33.8, 2.32.7, and 2.29.17. The fix enforces strict validation rejecting newlines and control characters in these settings.
Potential Impact
An attacker with control over the server-supplied SSH configuration values can inject arbitrary SSH directives into the user's SSH config file. This can lead to arbitrary code execution on the developer's workstation with the user's privileges, affecting all SSH connections initiated by that user. The impact includes full compromise of the local user environment via SSH configuration injection.
Mitigation Recommendations
Apply the official patches available in Coder versions 2.34.2, 2.33.8, 2.32.7, and 2.29.17 or later, which validate and sanitize server-supplied SSH configuration values to prevent injection. As a workaround, inspect the output of `coder config-ssh --dry-run` before applying changes to detect any malicious configuration directives. No other mitigations are specifically recommended.
V2: Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` (CVE-2026-55427)
Description
### Summary `coder config-ssh` wrote server-supplied SSH settings (`HostnameSuffix`, `SSHConfigOptions`) into the user's `~/.ssh/config` without sanitizing embedded newlines or restricting directives so a malicious or compromised Coder server could inject arbitrary SSH configuration. > **Note:** Practical exploitation requires control of the server-supplied values through a malicious or compromised deployment, a man-in-the-middle position or admin access to the `HostnameSuffix` and `SSHConfigOptions` settings. ### Impact A server administrator or an attacker who controlled the server, could inject a directive such as `ProxyCommand` and achieve arbitrary code execution on any developer workstation that ran `coder config-ssh`. Injected commands ran with the local user's privileges and applied to all SSH connections, not just Coder workspaces. ### Patches The fix validates `HostnameSuffix` and `SSHConfigOptions` against a strict character set that rejects newlines and other control characters. The fix was backported to all supported release lines: | Release line | Patched version | |---|---| | 2.34 | [v2.34.2](https://github.com/coder/coder/releases/tag/v2.34.2) | | 2.33 | [v2.33.8](https://github.com/coder/coder/releases/tag/v2.33.8) | | 2.32 | [v2.32.7](https://github.com/coder/coder/releases/tag/v2.32.7) | | 2.29 (ESR) | [v2.29.17](https://github.com/coder/coder/releases/tag/v2.29.17) | ### Workarounds Inspect `coder config-ssh --dry-run` output before applying changes. ### Resources - Fix: #26154 ### Credits Coder would like to thank Anthropic's Security Team (ANT-2026-22437) for independently disclosing this issue!
CVSS v3.1
Score 8.3high
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Coder's `config-ssh` command previously wrote server-supplied SSH settings (`HostnameSuffix`, `SSHConfigOptions`) directly into the user's SSH configuration file without sanitization. This allowed a malicious or compromised server to inject arbitrary SSH configuration directives, including those enabling arbitrary code execution (e.g., via `ProxyCommand`). Exploitation requires control over server-supplied values, such as through a compromised server or administrative access. The vulnerability is tracked as CVE-2026-55427 and has been patched in versions 2.34.2, 2.33.8, 2.32.7, and 2.29.17. The fix enforces strict validation rejecting newlines and control characters in these settings.
Potential Impact
An attacker with control over the server-supplied SSH configuration values can inject arbitrary SSH directives into the user's SSH config file. This can lead to arbitrary code execution on the developer's workstation with the user's privileges, affecting all SSH connections initiated by that user. The impact includes full compromise of the local user environment via SSH configuration injection.
Mitigation Recommendations
Apply the official patches available in Coder versions 2.34.2, 2.33.8, 2.32.7, and 2.29.17 or later, which validate and sanitize server-supplied SSH configuration values to prevent injection. As a workaround, inspect the output of `coder config-ssh --dry-run` before applying changes to detect any malicious configuration directives. No other mitigations are specifically recommended.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-mcqq-fqgf-rxwm
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-55427"]
- Ecosystems
- ["Go"]
- Database Specific Severity
- HIGH
- Cvss Version
- 3.1
Threat ID: 6a4c340327e9c797195f5f61
Added to database: 07/06/2026, 23:02:27 UTC
Last enriched: 07/06/2026, 23:13:14 UTC
Last updated: 07/31/2026, 19:22:59 UTC
Views: 63
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.