TI-2025-40847 Aliases CVE-2025-66411 GHSA-jf75-p25m-pw74

Coder logged sensitive objects unsanitized

LOW 34CWE-532Published 2025-12-03 · Updated 2025-12-03

Key facts

Attack vector: Local
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Information disclosure
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-532.

Summary

Coder allows organizations to provision remote development environments via Terraform. Prior to 2.26.5, 2.27.7, and 2.28.4, Workspace Agent manifests containing sensitive values were logged in plaintext unsanitized. An attacker with limited local access to the Coder Workspace (VM, K8s Pod etc.) or a third-party system (SIEM, logging stack) could access those logs. This vulnerability is fixed in 2.26.5, 2.27.7, and 2.28.4.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00249 16th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed coder (coder): 2.28.4, 2.27.7, 2.26.5github.com/coder/coder/v2 (Go): 2.26.5, 2.27.7, 2.28.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
coder	coder	2.28.0 to before 2.28.4; 2.27.0 to before 2.27.7; before 2.26.5	2.28.4, 2.27.7, 2.26.5	Patch available	CNA
—	github.com/coder/coder/v2 (Go)	before 2.26.5	2.26.5	Patch available	GHSA-jf75-p25m-pw74
—	github.com/coder/coder/v2 (Go)	2.27.0 to before 2.27.7	2.27.7	Patch available	GHSA-jf75-p25m-pw74
—	github.com/coder/coder/v2 (Go)	2.28.0 to before 2.28.4	2.28.4	Patch available	GHSA-jf75-p25m-pw74

coder Vendorcoder Affected 2.28.0 to before 2.28.4; 2.27.0 to before 2.27.7; before 2.26.5 Fixed in 2.28.4, 2.27.7, 2.26.5 Patch available CNA
github.com/coder/coder/v2 (Go) Vendor— Affected before 2.26.5 Fixed in 2.26.5 Patch available GHSA-jf75-p25m-pw74
github.com/coder/coder/v2 (Go) Vendor— Affected 2.27.0 to before 2.27.7 Fixed in 2.27.7 Patch available GHSA-jf75-p25m-pw74
github.com/coder/coder/v2 (Go) Vendor— Affected 2.28.0 to before 2.28.4 Fixed in 2.28.4 Patch available GHSA-jf75-p25m-pw74

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:coder:coder::::::go::*	before 2.26.5; 2.27.0 to before 2.27.7; 2.28.0 to before 2.28.4	Vulnerable	coder

cpe:2.3:a:coder:coder:*:*:*:*:*:go:*:* Versions before 2.26.5; 2.27.0 to before 2.27.7; 2.28.0 to before 2.28.4 Vulnerable ·coder

Remediation

Fix · CNA coder (coder) Fixed in 2.28.4, 2.27.7, 2.26.5
Fix · GHSA-jf75-p25m-pw74 github.com/coder/coder/v2 (Go) Fixed in 2.26.5 Advisory →
Fix · GHSA-jf75-p25m-pw74 github.com/coder/coder/v2 (Go) Fixed in 2.27.7 Advisory →
Fix · GHSA-jf75-p25m-pw74 github.com/coder/coder/v2 (Go) Fixed in 2.28.4 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2025-66411
2026-10-03 Alias added: GHSA-jf75-p25m-pw74

References

Other 7

TI-2026-34071 Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft CVSS 3.1CRITICAL 9.1
TI-2026-32394 Coder vulnerable to workspace auto-creation via crafted URL parameters without user consent CVSS 3.1HIGH 8.8
TI-2024-18523 Coder's OIDC authentication allows email with partially matching domain to register CVSS 3.1HIGH 8.2
TI-2026-39997 Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID CVSS 3.1HIGH 8.7
TI-2026-39996 Coder: Route hijacking through lack of validation of agent-supplied AllowedIPs in tailnet coordinator CVSS 3.1HIGH 8.2
TI-2026-39995 Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh` CVSS 3.1HIGH 8.3

See all 22 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences