Portal for ArcGIS wide open at CVSS 9.8, plus Coder's broken Azure auth

Coder's Azure instance identity validation checks the certificate chain but never actually verifies the PKCS#7 signature. An attacker who knows a target VM's UUIDv4 vmId can forge identity claims and steal a workspace agent's session token with no authentication. Knowing the vmId is a practical barrier, but if your Coder deployment faces the internet or an attacker has any foothold in your Azure environment, this is exploitable.

Affected estate

Teams running Coder with Azure instance identity authentication (azure-instance-identity) on versions before 2.24.5, 2.29.13, 2.30.8, 2.31.12, 2.32.2, or 2.33.3

How to check

Run `coder version` on your Coder server, and review your Terraform templates for any use of `azure-instance-identity` as the auth method.

Included because

unauthenticated; signature bypass; session token theft; CVSS 9.1

Action

Upgrade to the patched Coder version for your release branch. As a workaround, reconfigure Azure templates to use token auth.

Why it matters

A forged identity claim lets an attacker steal workspace agent session tokens and access remote dev environments.

Source

Coder GitHub advisory

If you use Rancher Fleet, anyone with git push access to a Fleet-monitored repo can overwrite Pod Security Standards labels on target namespaces. That lets them weaken admission controls and deploy workloads your PSS policies would normally block. The prerequisite is write access to a monitored Git repo, so this is an insider or supply-chain risk rather than a drive-by attack.

Affected estate

Teams using Rancher Fleet for GitOps-based Kubernetes deployments where PSS enforcement labels are relied on for admission control

How to check

Check your Fleet agent version and review namespace labels with `kubectl get ns <namespace> -o yaml` for any unexpected pod-security.kubernetes.io/* labels.

Included because

authenticated but low-privilege; affects admission controls; CVSS 8.8; supply-chain vector

Action

Upgrade the Fleet agent to the patched release and audit namespace labels across clusters for tampering.

Why it matters

An attacker with repo access can silently disable Pod Security Standards, letting privileged or dangerous workloads run unchecked.

Source

Fleet / Rancher vendor advisory

The password recovery mechanism in Portal for ArcGIS 12.1 and earlier is weak enough that a remote, unauthenticated attacker can manipulate it to take over user accounts. If you haven't configured an email server for self-service password recovery, this is especially easy to exploit.

Affected estate

Anyone running Esri Portal for ArcGIS 12.1 or earlier on Windows, Linux, or Kubernetes

How to check

Check your Portal version via the Administrator Directory (/portaladmin). Also verify whether an email server (SMTP) is configured under ArcGIS Enterprise settings.

Included because

unauthenticated; account takeover; CVSS 8.1; internet-facing possible

Action

Patch Portal for ArcGIS and confirm an email server is configured so password recovery flows through legitimate email verification.

Why it matters

An attacker can take over user accounts remotely without any credentials, potentially gaining access to sensitive geospatial data and Portal admin functions.

Source

Esri vendor advisory

OpenSSH clients before 10.4 have a use-after-free bug that triggers when a server changes its host key during a key re-exchange. This is client-side only, so your SSH servers aren't directly vulnerable, but any machine running an affected OpenSSH client and connecting to a malicious (or compromised) server could be exploited. The scenario requires a server to initiate a host key change mid-session, which limits practical exploitation.

Affected estate

Anyone running OpenSSH client versions before 10.4 on Linux, macOS, or other Unix-like systems

How to check

Run `ssh -V` on your systems. Any version below OpenSSH 10.4 is affected.

Included because

client-side; requires malicious server; CVSS 7.7; widely deployed software

Action

Update OpenSSH to 10.4 or later via your package manager or from source.

Why it matters

A use-after-free on the client side could let a malicious server crash or potentially execute code on connecting clients.

Source

OpenSSH release notes / NVD