Coder provides remote development environments via Terraform. Versions prior to 2.24.5, 2.29.13, 2.30.8, 2.31.12, 2.32.2, and 2.33.3 are vulnerable to unauthenticated semi‑blind Server‑Side Request Forgery through the Azure instance identity endpoint (POST /api/v2/workspaceagents/azure-instance-identity). An attacker who submits a crafted PKCS#7 signature can cause the Coder server to issue HTTP GET requests to arbitrary internal or external hosts. Although the server does not return the target’s response body, error messages in the API response reveal whether the host is reachable and the nature of any failure, allowing discovery of internal services. This CWE‑918 flaw can be exploited without authentication and is deemed a moderate‑severity vulnerability per the CVSS score of 6.5, with an EPSS probability of <1%.

The Coder application (vendor coder:coder) running any version earlier than 2.24.5, 2.29.13, 2.30.8, 2.31.12, 2.32.2, or 2.33.3 is vulnerable.

The CVSS score of 6.5 indicates moderate severity. The EPSS score of <1% reflects a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Because the endpoint can be reached without authentication, an attacker can exploit the flaw simply by issuing a crafted POST request to the exposed endpoint.