{"id":"CVE-2026-118687","kind":"vulnerability","aliases":["CVE-2026-118687"],"related":[],"title":"Coder: GCE identity token replay yields workspace agent session token","description":"Coder before 2.29.21, 2.30.0 before 2.34.12, 2.35.0 before 2.35.9, 2.36.0 before 2.36.7, and 2.37.0 before 2.37.4 does not validate the audience claim of GCE instance-identity JWTs at the POST /api/v2/workspaceagents/google-instance-identity endpoint. Attackers who obtain an unexpired format=full identity token minted for another relying party can replay it to obtain that workspace agent's session token, which remains valid until the workspace's next build.","summary":"Coder does not check the audience claim of Google Compute Engine instance-identity JWTs at its workspace agent login endpoint. An attacker holding an unexpired token minted for another service can replay it to obtain that workspace agent's session token, which stays valid until the workspace's next build.","severity":"high","cvss":8.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["coder","gcp","package","self-hosted","workspace-agents"],"not_affected_if":["no-gcp-instance-identity","patched-version"],"how_to_check":"- Check the installed Coder server version with `coder version` or the server's `/api/v2/buildinfo` response.\n- Confirm whether workspaces run on Google Compute Engine with Google instance-identity authentication enabled (unknown whether the sources list a specific config key).","fix":"- Upgrade Coder to `2.29.21`, `2.34.12`, `2.35.9`, `2.36.7`, or `2.37.4` depending on the release line in use.\n- After upgrading, rebuild workspaces or rotate workspace agent tokens, since existing session tokens remain valid until the next build (unknown whether the sources recommend a specific rotation step).","status":"open","published_at":"2026-10-28T19:17:35+00:00","first_seen_at":"2026-10-28T19:34:56+00:00","triaged_at":"2026-10-28T19:35:55+00:00","updated_at":"2026-10-28T19:35:55+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-28T19:35:55Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Coder to `2.29.21`, `2.34.12`, `2.35.9`, `2.36.7`, or `2.37.4` depending on the release line in use.\n- After upgrading, rebuild workspaces or rotate workspace agent tokens, since existing session tokens remain valid until the next build (unknown whether the sources recommend a specific rotation step).","reach":"network","title":"Coder: GCE identity token replay yields workspace agent session token","impact":"high","summary":"Coder does not check the audience claim of Google Compute Engine instance-identity JWTs at its workspace agent login endpoint. An attacker holding an unexpired token minted for another service can replay it to obtain that workspace agent's session token, which stays valid until the workspace's next build.","category":"package","nicknames":[],"who_cares":["coder","self-hosted","gcp","workspace-agents"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker takes over a workspace agent session via replayed identity token","analyst_note":"Confirm the exact fixed versions for each release line and whether a token rotation or workspace rebuild is required, using the NVD entry and Coder's advisory.","how_to_check":"- Check the installed Coder server version with `coder version` or the server's `/api/v2/buildinfo` response.\n- Confirm whether workspaces run on Google Compute Engine with Google instance-identity authentication enabled (unknown whether the sources list a specific config key).","needs_analyst":true,"not_affected_if":["patched-version","no-gcp-instance-identity"],"who_is_affected":"Teams running self-hosted Coder servers in the affected version ranges that use GCE instance-identity authentication for workspace agents. Deployments not using Google instance-identity login, or running a patched release, are not exposed by this flaw.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000675,"input_tokens":3432,"output_tokens":664,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-118687':13A,16A '-2026':12A,15A '/api/v2/workspaceagents/google-instance-identity':108C '2.29.21':79C '2.30.0':80C '2.34.12':82C '2.35.0':83C '2.35.9':85C '2.36.0':86C '2.36.7':88C '2.37.0':90C '2.37.4':92C 'agent':8A,25B,44B,64B,131C 'anoth':55B,121C 'attack':48B,110C 'audienc':31B,97C 'build':76B,143C 'check':29B 'claim':32B,98C 'coder':1A,17B,26B,77C 'comput':35B 'cve':11A,14A 'endpoint':46B,109C 'engin':36B 'format':115C 'full':116C 'gce':2A,100C 'gcp':18B 'googl':34B 'hold':49B 'host':22B 'ident':3A,39B,103C,117C 'instanc':38B,102C 'instance-ident':37B,101C 'jwts':40B,104C 'login':45B 'mint':53B,119C 'next':75B,142C 'obtain':61B,112C,128C 'packag':19B 'parti':123C 'post':107C 'reli':122C 'remain':136C 'replay':5A,58B,125C 'self':21B 'self-host':20B 'servic':56B 'session':9A,66B,133C 'stay':69B 'token':4A,10A,52B,67B,118C,134C 'unexpir':51B,114C 'valid':70B,95C,137C 'workspac':7A,24B,43B,63B,73B,130C,140C 'workspace-ag':23B 'yield':6A","nicknames":[],"mitigations":[],"who_affected":"Teams running self-hosted Coder servers in the affected version ranges that use GCE instance-identity authentication for workspace agents. Deployments not using Google instance-identity login, or running a patched release, are not exposed by this flaw.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T19:17:35+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118687","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118687","severity":null,"published_at":"2026-10-28T19:17:35+00:00","modified_at":"2026-10-28T19:17:35+00:00","first_seen_at":"2026-10-28T19:34:56+00:00","fetched_at":"2026-10-28T19:34:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}