medium6.5
CVE-2026-118687
Coder before 2.29.21, 2.30.0 before 2.34.12, 2.35.0 before 2.35.9, 2.36.0 before 2.36.7, and 2.37.0 before 2.37.4 does not validate the audience claim of GCE i…
Impact
Coder before 2.29.21, 2.30.0 before 2.34.12, 2.35.0 before 2.35.9, 2.36.0 before 2.36.7, and 2.37.0 before 2.37.4 does not validate the audience claim of GCE instance-identity JWTs at the POST /api/v2/workspaceagents/google-instance-identity endpoint. Attackers who obtain an unexpired format=full identity token minted for another relying party can replay it to obtain that workspace agent's session token, which remains valid until the workspace's next build.
Affected products
| Product | Affected versions |
|---|---|
| Coder | before 2.29.21 |
| 2.30.0 | before 2.34.12 |
| 2.35.0 | before 2.35.9 |
| 2.36.0 | before 2.36.7 |
| And 2.37.0 | before 2.37.4 |
Versions were read from the advisory text. No structured product data has been published for this record yet.