Live › vulnerability › CVE-2026-118687
Go to dashboardCoder does not check the audience claim of Google Compute Engine instance-identity JWTs at its workspace agent login endpoint. An attacker holding an unexpired token minted for another service can replay it to obtain that workspace agent's session token, which stays valid until the workspace's next build.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 19:34 UTC. All times on this page are UTC.
Teams running self-hosted Coder servers in the affected version ranges that use GCE instance-identity authentication for workspace agents. Deployments not using Google instance-identity login, or running a patched release, are not exposed by this flaw.
No product ranges from the sources yet.
coder version or the server's /api/v2/buildinfo response.2.29.21, 2.34.12, 2.35.9, 2.36.7, or 2.37.4 depending on the release line in use.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Coder before 2.29.21, 2.30.0 before 2.34.12, 2.35.0 before 2.35.9, 2.36.0 before 2.36.7, and 2.37.0 before 2.37.4 does not validate the audience claim of GCE instance-identity JWTs at the POST /api/v2/workspaceagents/google-instance-identity endpoint. Attackers who obtain an unexpired format=full identity token minted for another relying party can replay it to obtain that workspace agent's session token, which remains valid until the workspace's next build.
This page as .md · .json · in your agent: get_signal("CVE-2026-118687")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.