HIGH 8.3 NVD
CVE-2026-118687
Coder before 2.29.21, 2.30.0 before 2.34.12, 2.35.0 before 2.35.9, 2.36.0 before 2.36.7, and 2.37.0 before 2.37.4 does not validate the audience claim of GCE in
Coder before 2.29.21, 2.30.0 before 2.34.12, 2.35.0 before 2.35.9, 2.36.0 before 2.36.7, and 2.37.0 before 2.37.4 does not validate the audience claim of GCE instance-identity JWTs at the POST /api/v2/workspaceagents/google-instance-identity endpoint. Attackers who obtain an unexpired format=full identity token minted for another relying party can replay it to obtain that workspace agent's session token, which remains valid until the workspace's next build.
References
- https://github.com/coder/coder/security/advisories/GHSA-24vh-q7rg-243w
- https://www.vulncheck.com/advisories/coder-before-2.29.21-2.34.12-2.35.9-2.36.7-and-2.37.4
This high severity vulnerability with a CVSS score of 8.3 was published on 2026-10-28 via NVD.
vulnfeed aggregates 14990 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.