CVE-2026-118687
CVE-2026-118687 · Coder before 2.29.21, 2.34.12, 2.35.9, 2.36.7, and 2.37.4 Missing Audience Validation in GCP Instance-Identity Authentication
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Coder before 2.29.21, 2.30.0 before 2.34.12, 2.35.0 before 2.35.9, 2.36.0 before 2.36.7, and 2.37.0 before 2.37.4 does not validate the audience claim of GCE instance-identity JWTs at the POST /api/v2/workspaceagents/google-instance-identity endpoint. Attackers who obtain an unexpired format=full identity token minted for another relying party can replay it to obtain that workspace agent's session token, which remains valid until the workspace's next build.
CVSS 8.3 · High · EPSS 0.2% · Fix available
- Published
- Updated
Affected products and versions
coder
- Versions
- ≥ 2.37.0, < 2.37.4: Affected (semver)
- 2.37.4: Not affected (semver)
Update to 2.37.4
coder
- Versions
- ≥ 2.36.0, < 2.36.7: Affected (semver)
- 2.36.7: Not affected (semver)
Update to 2.36.7
coder
- Versions
- ≥ 2.35.0, < 2.35.9: Affected (semver)
- 2.35.9: Not affected (semver)
Update to 2.35.9
coder
- Versions
- ≥ 2.30.0, < 2.34.12: Affected (semver)
- 2.34.12: Not affected (semver)
Update to 2.34.12
coder
- Versions
- ≥ 0, < 2.29.21: Affected (semver)
- 2.29.21: Not affected (semver)
Update to 2.29.21