CVE-2026-55427: Anthropic Python SSH config injection

Q: Is CVE-2026-55427 actively exploited?

No confirmed active exploitation of CVE-2026-55427 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2026-55427?

1) Patch immediately to the version matching your release line: v2.34.2, v2.33.8, v2.32.7, or v2.29.17 (ESR). 2) Until patched, always run `coder config-ssh --dry-run` and manually inspect output before applying. 3) Audit existing `~/.ssh/config` files on developer machines for unexpected `ProxyCommand`, `Match`, or other injected directives. 4) Restrict who can set `HostnameSuffix`/`SSHConfigOptions` on the Coder server to trusted admins only, and treat those settings as sensitive configuration requiring change control. 5) Monitor for unusual SSH connection behavior or unexpected process spawns correlated with SSH client invocation on developer endpoints.

Q: What systems are affected by CVE-2026-55427?

This vulnerability affects the following AI/ML architecture patterns: cloud/remote AI development environments, agent-assisted coding workflows, CI/CD pipelines for ML.

Q: What is the CVSS score for CVE-2026-55427?

CVE-2026-55427 has a CVSS v3.1 base score of 8.3 (HIGH). The EPSS exploitation probability is 0.27%.

CISO Take

Coder's `config-ssh` CLI writes server-supplied SSH settings (HostnameSuffix, SSHConfigOptions) straight into a developer's `~/.ssh/config` without stripping embedded newlines, letting a malicious or compromised Coder server inject directives like `ProxyCommand` and achieve arbitrary code execution on any workstation that runs the command. With 5,435 downstream dependents and 35 other CVEs already tracked against this package, a single compromised, MITM'd, or insider-abused Coder deployment can pivot into every connected engineer's laptop with local-user privileges — and the injected directive applies to all SSH connections, not just Coder workspaces. There's no public exploit, no Nuclei template, and it isn't in CISA KEV, so this is a plausible-but-not-yet-weaponized supply-chain risk rather than an imminent mass-exploitation threat; exploitation still requires attacker control of server-side config or admin access. Patch to v2.34.2, v2.33.8, v2.32.7, or v2.29.17 (ESR) depending on your release line, and until every workstation is patched, treat `coder config-ssh --dry-run` review as mandatory and audit existing `~/.ssh/config` files for unexpected `ProxyCommand` entries.

Sources: NVD GitHub Advisory CISA KEV ATLAS

What is the risk?

High severity (CVSS 8.3) but exploitation is gated by AC:H and PR:N/UI:R — the attacker needs control over server-supplied SSH settings (malicious/compromised Coder deployment, MITM position, or admin access), not a remotely triggerable bug on its own. No EPSS score, no CISA KEV listing, and no public exploit or scanner template exist yet, so real-world exploitation likelihood is currently low but the technique (SSH config directive injection via unsanitized newlines) is well documented and trivial to weaponize once an attacker has the required position. The realistic risk population is organizations self-hosting Coder for engineering/AI teams, especially where server admin duties are distributed or where Coder deployments could be MITM'd on untrusted networks.

How does the attack unfold?

Initial positioning

Attacker compromises, operates, or gains admin/MITM access to a Coder server that supplies HostnameSuffix/SSHConfigOptions values.

AML.T0010

Malicious config injection

Attacker sets a server-side setting containing an embedded newline and a ProxyCommand directive.

Unsanitized delivery

Developer runs `coder config-ssh`, which writes the attacker's directive verbatim into their local ~/.ssh/config.

Code execution impact

On the next SSH connection, the injected ProxyCommand executes arbitrary code with the developer's local privileges.

AML.T0050

Initial positioning

Attacker compromises, operates, or gains admin/MITM access to a Coder server that supplies HostnameSuffix/SSHConfigOptions values.

AML.T0010

Malicious config injection

Attacker sets a server-side setting containing an embedded newline and a ProxyCommand directive.

Unsanitized delivery

Developer runs `coder config-ssh`, which writes the attacker's directive verbatim into their local ~/.ssh/config.

Code execution impact

On the next SSH connection, the injected ProxyCommand executes arbitrary code with the developer's local privileges.

AML.T0050

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Anthropic Python	go	>= 2.34.0, < 2.34.2	`2.34.2`
3.8K 5.2K dependents Pushed yesterday 90% patched ~11d to patch Full package profile →

Do you use Anthropic Python? You're affected.

How severe is it?

CVSS 3.1

8.3 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 19% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC High

PR None

UI Required

S Changed

C High

I High

A High

What should I do?

1 step

1) Patch immediately to the version matching your release line: v2.34.2, v2.33.8, v2.32.7, or v2.29.17 (ESR). 2) Until patched, always run coder config-ssh --dry-run and manually inspect output before applying. 3) Audit existing ~/.ssh/config files on developer machines for unexpected ProxyCommand, Match, or other injected directives. 4) Restrict who can set HostnameSuffix/SSHConfigOptions on the Coder server to trusted admins only, and treat those settings as sensitive configuration requiring change control. 5) Monitor for unusual SSH connection behavior or unexpected process spawns correlated with SSH client invocation on developer endpoints.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code Execution Supply Chain Agent AML.T0010 - AI Supply Chain Compromise AML.T0050 - Command and Scripting Interpreter

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

NIST AI RMF

GOVERN 6.1 - Third-party risk policies and procedures

Frequently Asked Questions

What is CVE-2026-55427?

Coder's `config-ssh` CLI writes server-supplied SSH settings (HostnameSuffix, SSHConfigOptions) straight into a developer's `~/.ssh/config` without stripping embedded newlines, letting a malicious or compromised Coder server inject directives like `ProxyCommand` and achieve arbitrary code execution on any workstation that runs the command. With 5,435 downstream dependents and 35 other CVEs already tracked against this package, a single compromised, MITM'd, or insider-abused Coder deployment can pivot into every connected engineer's laptop with local-user privileges — and the injected directive applies to all SSH connections, not just Coder workspaces. There's no public exploit, no Nuclei template, and it isn't in CISA KEV, so this is a plausible-but-not-yet-weaponized supply-chain risk rather than an imminent mass-exploitation threat; exploitation still requires attacker control of server-side config or admin access. Patch to v2.34.2, v2.33.8, v2.32.7, or v2.29.17 (ESR) depending on your release line, and until every workstation is patched, treat `coder config-ssh --dry-run` review as mandatory and audit existing `~/.ssh/config` files for unexpected `ProxyCommand` entries.

Is CVE-2026-55427 actively exploited?

No confirmed active exploitation of CVE-2026-55427 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-55427?

1) Patch immediately to the version matching your release line: v2.34.2, v2.33.8, v2.32.7, or v2.29.17 (ESR). 2) Until patched, always run `coder config-ssh --dry-run` and manually inspect output before applying. 3) Audit existing `~/.ssh/config` files on developer machines for unexpected `ProxyCommand`, `Match`, or other injected directives. 4) Restrict who can set `HostnameSuffix`/`SSHConfigOptions` on the Coder server to trusted admins only, and treat those settings as sensitive configuration requiring change control. 5) Monitor for unusual SSH connection behavior or unexpected process spawns correlated with SSH client invocation on developer endpoints.

What systems are affected by CVE-2026-55427?

This vulnerability affects the following AI/ML architecture patterns: cloud/remote AI development environments, agent-assisted coding workflows, CI/CD pipelines for ML.

What is the CVSS score for CVE-2026-55427?

CVE-2026-55427 has a CVSS v3.1 base score of 8.3 (HIGH). The EPSS exploitation probability is 0.27%.

What is the AI security impact?

Affected AI Architectures

cloud/remote AI development environmentsagent-assisted coding workflowsCI/CD pipelines for ML

MITRE ATLAS Techniques

AML.T0010 AI Supply Chain Compromise

AML.T0050 Command and Scripting Interpreter

Compliance Controls Affected

EU AI Act: Article 15

NIST AI RMF: GOVERN 6.1

What are the technical details?

Original Advisory

### Summary `coder config-ssh` wrote server-supplied SSH settings (`HostnameSuffix`, `SSHConfigOptions`) into the user's `~/.ssh/config` without sanitizing embedded newlines or restricting directives so a malicious or compromised Coder server could inject arbitrary SSH configuration. > **Note:** Practical exploitation requires control of the server-supplied values through a malicious or compromised deployment, a man-in-the-middle position or admin access to the `HostnameSuffix` and `SSHConfigOptions` settings. ### Impact A server administrator or an attacker who controlled the server, could inject a directive such as `ProxyCommand` and achieve arbitrary code execution on any developer workstation that ran `coder config-ssh`. Injected commands ran with the local user's privileges and applied to all SSH connections, not just Coder workspaces. ### Patches The fix validates `HostnameSuffix` and `SSHConfigOptions` against a strict character set that rejects newlines and other control characters. The fix was backported to all supported release lines: | Release line | Patched version | |---|---| | 2.34 | [v2.34.2](https://github.com/coder/coder/releases/tag/v2.34.2) | | 2.33 | [v2.33.8](https://github.com/coder/coder/releases/tag/v2.33.8) | | 2.32 | [v2.32.7](https://github.com/coder/coder/releases/tag/v2.32.7) | | 2.29 (ESR) | [v2.29.17](https://github.com/coder/coder/releases/tag/v2.29.17) | ### Workarounds Inspect `coder config-ssh --dry-run` output before applying changes. ### Resources - Fix: #26154 ### Credits Coder would like to thank Anthropic's Security Team (ANT-2026-22437) for independently disclosing this issue!

Exploitation Scenario

An attacker who compromises a self-hosted Coder deployment (or operates a malicious one, gains admin access, or achieves a MITM position against the Coder API) sets `HostnameSuffix` or `SSHConfigOptions` to a value containing an embedded newline followed by a `ProxyCommand` directive pointing at an attacker-controlled command. A developer on the AI/ML engineering team runs `coder config-ssh` to sync their local SSH configuration, and the unsanitized directive is written verbatim into `~/.ssh/config`. The next time that developer opens any SSH connection — to a Coder workspace or otherwise — the injected `ProxyCommand` executes with the developer's local privileges, giving the attacker code execution on the workstation and access to any locally stored credentials, including AI API keys and cloud ML service tokens.

Weaknesses (CWE)

CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') Primary CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') Primary CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CWE-74 — Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'): The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

[Requirements] Programming languages and supporting technologies might be chosen which are not subject to these issues.
[Implementation] Utilize an appropriate mix of allowlist and denylist parsing to filter control-plane syntax from all input.

Source: MITRE CWE corpus.