Workspace Creation Parameter Injection in Coder

Executive Summary

This vulnerability affects Coder, a tool that allows organizations to provision remote development environments via Terraform. In versions prior to 2.29.7 and 2.30.2, when creating workspaces using 'mode=auto' deep links, the system would silently provision workspaces with parameters controlled by an attacker without requiring any explicit user confirmation.

This means an attacker could craft a link that, when used, would automatically create a workspace with parameters they chose, potentially leading to unauthorized configurations or access.

In versions 2.29.7 and 2.30.2, a consent dialog was introduced that displays all prefilled parameters and blocks workspace creation until the user explicitly confirms by clicking 'Confirm and Create', mitigating the issue.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to unauthorized creation of remote development workspaces with attacker-controlled parameters without user consent.

Such unauthorized provisioning could allow attackers to influence the environment configuration, potentially leading to unauthorized access, data exposure, or manipulation within the affected system.

Given the CVSS score of 8.1 with high impact on confidentiality and integrity, the vulnerability poses a significant risk to the security of the affected environments.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, update Coder to version 2.29.7 or 2.30.2 or later, where a consent dialog has been added to require explicit user confirmation before workspace creation with prefilled parameters.

Useful 0 Not Useful 0

Compliance Impact

CVE-2026-44454 allows arbitrary code execution within provisioned workspaces by exploiting unsanitized user input in the dotfiles registry module. This can lead to exposure of sensitive data such as Git credentials, secrets, and workspace files, which may include personal or protected information.

Such unauthorized access and potential data exposure could negatively impact compliance with data protection regulations like GDPR and HIPAA, which require strict controls over personal and sensitive data to prevent unauthorized access and breaches.

The vulnerability was mitigated by adding input validation to reject unsafe inputs and introducing a consent dialog to prevent silent workspace creation with attacker-controlled parameters, thereby reducing the risk of unauthorized code execution and data exposure.

These security improvements help organizations maintain compliance by enforcing explicit user consent and preventing automated attacks that could compromise sensitive data.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves unsanitized user input in the dotfiles registry module that allows arbitrary code execution via crafted dotfiles_uri values, especially when workspace creation links use the mode=auto parameter with prefilled parameters.

To detect exploitation attempts on your network or system, you should monitor for suspicious workspace creation requests that include unusual or suspicious dotfiles_uri values containing shell command substitutions such as $(...).

Specifically, you can look for HTTP requests or logs containing URLs with the parameter param.dotfiles_uri that include characters like $(), backticks, or other shell metacharacters.

Suggested commands to detect such attempts might include searching web server or application logs for suspicious patterns. For example, using grep on logs:

• grep -E 'param\.dotfiles_uri=.*\$\(|param\.dotfiles_uri=.*`' /path/to/access.log
• grep -i 'mode=auto' /path/to/access.log | grep -E '\$\(|`'

Additionally, monitoring workspace creation events for unexpected or unauthorized provisioning, especially those triggered without explicit user consent, can help detect exploitation.

Since the vulnerability was fixed by adding input validation and a consent dialog, ensuring your system is updated to versions 2.29.7 or 2.30.2 or later will mitigate this risk.

Useful 0 Not Useful 0