CVE-2026-118687

Coder before 2.29.21, 2.30.0 before 2.34.12, 2.35.0 before 2.35.9, 2.36.0 before 2.36.7, and 2.37.0 before 2.37.4 does not validate the audience claim of GCE instance-identity JWTs at the POST /api/v2/workspaceagents/google-instance-identity endpoint. Attackers who obtain an unexpired format=full identity token minted for another relying party can replay it to obtain that workspace agent's session token, which remains valid until the workspace's next build.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.2 / Impact : 4.2

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/coder/coder/security/advisories/GHSA-24vh-q7rg-243w
https://www.vulncheck.com/advisories/coder-before-2.29.21-2.34.12-2.35.9-2.36.7-and-2.37.4-missing-audience-validation-in-gcp-instance-identity-authentication

Configurations

No configuration.

History

28 Oct 2026, 19:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-10-28 19:17

Updated : 2026-10-29 21:17

NVD link : CVE-2026-118687

Mitre link : CVE-2026-118687

CVE.ORG link : CVE-2026-118687

JSON object : View

Products Affected

No product.

CWE

CWE-441

Unintended Proxy or Intermediary ('Confused Deputy')

{"id": "CVE-2026-118687", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-118687", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-29T15:28:59.226439Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 4.2, "exploitabilityScore": 2.2}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "coder", "product": "coder", "versions": [{"status": "affected", "version": "2.37.0", "lessThan": "2.37.4", "versionType": "semver"}, {"status": "unaffected", "version": "2.37.4", "versionType": "semver"}], "packageURL": "pkg:golang/github.com/coder/coder/v2", "defaultStatus": "unaffected"}, {"vendor": "coder", "product": "coder", "versions": [{"status": "affected", "version": "2.36.0", "lessThan": "2.36.7", "versionType": "semver"}, {"status": "unaffected", "version": "2.36.7", "versionType": "semver"}], "packageURL": "pkg:golang/github.com/coder/coder/v2", "defaultStatus": "unaffected"}, {"vendor": "coder", "product": "coder", "versions": [{"status": "affected", "version": "2.35.0", "lessThan": "2.35.9", "versionType": "semver"}, {"status": "unaffected", "version": "2.35.9", "versionType": "semver"}], "packageURL": "pkg:golang/github.com/coder/coder/v2", "defaultStatus": "unaffected"}, {"vendor": "coder", "product": "coder", "versions": [{"status": "affected", "version": "2.30.0", "lessThan": "2.34.12", "versionType": "semver"}, {"status": "unaffected", "version": "2.34.12", "versionType": "semver"}], "packageURL": "pkg:golang/github.com/coder/coder/v2", "defaultStatus": "unaffected"}, {"vendor": "coder", "product": "coder", "versions": [{"status": "affected", "version": "0", "lessThan": "2.29.21", "versionType": "semver"}, {"status": "unaffected", "version": "2.29.21", "versionType": "semver"}], "packageURL": "pkg:golang/github.com/coder/coder/v2", "defaultStatus": "unaffected"}]}], "published": "2026-10-28T19:17:35.807", "references": [{"url": "https://github.com/coder/coder/security/advisories/GHSA-24vh-q7rg-243w", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/coder-before-2.29.21-2.34.12-2.35.9-2.36.7-and-2.37.4-missing-audience-validation-in-gcp-instance-identity-authentication", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-441"}]}], "descriptions": [{"lang": "en", "value": "Coder before 2.29.21, 2.30.0 before 2.34.12, 2.35.0 before 2.35.9, 2.36.0 before 2.36.7, and 2.37.0 before 2.37.4 does not validate the audience claim of GCE instance-identity JWTs at the POST /api/v2/workspaceagents/google-instance-identity endpoint. Attackers who obtain an unexpired format=full identity token minted for another relying party can replay it to obtain that workspace agent's session token, which remains valid until the workspace's next build."}], "lastModified": "2026-10-29T21:17:16.610", "sourceIdentifier": "disclosure@vulncheck.com"}