---
id: "CVE-2026-118687"
kind: "vulnerability"
aliases: ["CVE-2026-118687"]
title: "Coder: GCE identity token replay yields workspace agent session token"
severity: "high"
cvss: 8.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["coder", "gcp", "package", "self-hosted", "workspace-agents"]
not_affected_if: ["no-gcp-instance-identity", "patched-version"]
published_at: "2026-10-28T19:17:35+00:00"
first_seen_at: "2026-10-28T19:34:56+00:00"
updated_at: "2026-10-28T19:35:55+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118687", "first_seen_at": "2026-10-28T19:34:56+00:00"}]
---

# Coder: GCE identity token replay yields workspace agent session token

Coder does not check the audience claim of Google Compute Engine instance-identity JWTs at its workspace agent login endpoint. An attacker holding an unexpired token minted for another service can replay it to obtain that workspace agent's session token, which stays valid until the workspace's next build.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Coder server version with `coder version` or the server's `/api/v2/buildinfo` response.
- Confirm whether workspaces run on Google Compute Engine with Google instance-identity authentication enabled (unknown whether the sources list a specific config key).

## Fix

- Upgrade Coder to `2.29.21`, `2.34.12`, `2.35.9`, `2.36.7`, or `2.37.4` depending on the release line in use.
- After upgrading, rebuild workspaces or rotate workspace agent tokens, since existing session tokens remain valid until the next build (unknown whether the sources recommend a specific rotation step).

## Timeline

- 2026-10-28T19:34:56+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118687

## From the sources

Coder before 2.29.21, 2.30.0 before 2.34.12, 2.35.0 before 2.35.9, 2.36.0 before 2.36.7, and 2.37.0 before 2.37.4 does not validate the audience claim of GCE instance-identity JWTs at the POST /api/v2/workspaceagents/google-instance-identity endpoint. Attackers who obtain an unexpired format=full identity token minted for another relying party can replay it to obtain that workspace agent's session token, which remains valid until the workspace's next build.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_