Coder allows organizations to provision remote development environments via Terraform. Versions prior to 2.24.5, 2.29.13, 2.30.8, 2.31.12, 2.32.2, and 2.33.3 are vulnerable to unauthenticated semi‑blind Server‑Side Request Forgery through the Azure instance identity endpoint (POST /api/v2/workspaceagents/azure-instance-identity). An attacker can submit a crafted PKCS#7 signature that forces the Coder server to issue HTTP GET requests to arbitrary internal or external hosts. The server does not return the target’s response body, but error messages in the API response reveal whether the host is reachable and indicate the type of failure, enabling discovery of internal services. The issue was patched in releases 2.24.5, 2.29.13, 2.30.8, 2.31.12, 2.32.2, and 2.33.3. A workaround is to restrict access to the endpoint when Azure identity authentication is not used.

The Coder application (vendor coder:coder) running any version earlier than 2.24.5, 2.29.13, 2.30.8, 2.31.12, 2.32.2, or 2.33.3 is vulnerable.

The CVSS score of 6.5 indicates moderate severity. The EPSS score of <1% reflects a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Because the endpoint can be reached without authentication, an attacker can exploit the flaw simply by issuing a crafted POST request to the exposed endpoint.