Coder's privilege escalation vulnerability could lead to a cross workspace compromise
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass, Privilege escalation
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-613 and CWE-269.
Summary
Coder allows organizations to provision remote development environments via Terraform. In versions 2.22.0 through 2.24.3, 2.25.0 and 2.25.1, Coder can be compromised through insecure session handling in prebuilt workspaces. Coder automatically generates a session token for a user when a workspace is started. It is automatically exposed via coder_workspace_owner.session_token. Prebuilt workspaces are initially owned by a built-in prebuilds system user. When a prebuilt workspace is claimed, a new session token is generated for the user that claimed the workspace, but the previous session token for the prebuilds user was not expired. Any Coder workspace templates that persist this automatically generated session token are potentially impacted. This is fixed in versions 2.24.4 and 2.25.2.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| coder | coder | 2.22.0 to before 2.24.4; 2.25.0 to before 2.25.2 | 2.24.4, 2.25.2 | Patch available | CNA |
| — | github.com/coder/coder/v2 (Go) | 2.22.0 to before 2.24.4 | 2.24.4 | Patch available | GHSA-j6xf-jwrj-v5qp |
| — | github.com/coder/coder/v2 (Go) | 2.25.0 to before 2.25.2 | 2.25.2 | Patch available | GHSA-j6xf-jwrj-v5qp |
- coder Vendorcoder Affected 2.22.0 to before 2.24.4; 2.25.0 to before 2.25.2 Fixed in 2.24.4, 2.25.2 Patch available CNA
- github.com/coder/coder/v2 (Go) Vendor— Affected 2.22.0 to before 2.24.4 Fixed in 2.24.4 Patch available GHSA-j6xf-jwrj-v5qp
- github.com/coder/coder/v2 (Go) Vendor— Affected 2.25.0 to before 2.25.2 Fixed in 2.25.2 Patch available GHSA-j6xf-jwrj-v5qp
Remediation
- Fix · CNA coder (coder) Fixed in 2.24.4, 2.25.2
- Fix · GHSA-j6xf-jwrj-v5qp github.com/coder/coder/v2 (Go) Fixed in 2.24.4 Advisory →
- Fix · GHSA-j6xf-jwrj-v5qp github.com/coder/coder/v2 (Go) Fixed in 2.25.2 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2025-58437
- 2026-10-03 Alias added: GHSA-j6xf-jwrj-v5qp
References
Patch 3
More Coder vulnerabilities
- TI-2026-34071 Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft CVSS 3.1CRITICAL 9.1
- TI-2026-32394 Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent CVSS 3.1HIGH 8.8
- TI-2024-18523 Coder's OIDC authentication allows email with partially matching domain to register CVSS 3.1HIGH 8.2
- TI-2026-39997 Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID CVSS 3.1HIGH 8.7
- TI-2026-39996 Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator CVSS 3.1HIGH 8.2
- TI-2026-39995 Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` CVSS 3.1HIGH 8.3
Sources
- CVE-2025-58437 · CVE Program
- CVE-2025-58437 · NVD
- FIRST EPSS
- GHSA-j6xf-jwrj-v5qp · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences