CVE-2026-118687 in Coder
Summary
by MITRE • 10/28/2026
Coder before 2.29.21, 2.30.0 before 2.34.12, 2.35.0 before 2.35.9, 2.36.0 before 2.36.7, and 2.37.0 before 2.37.4 does not validate the audience claim of GCE instance-identity JWTs at the POST /api/v2/workspaceagents/google-instance-identity endpoint. Attackers who obtain an unexpired format=full identity token minted for another relying party can replay it to obtain that workspace agent's session token, which remains valid until the workspace's next build.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/28/2026
The vulnerability identified in Coder versions prior to 2.37.4 represents a critical authentication bypass within the Google Cloud Engine (GCE) instance identity verification mechanism. Specifically, this flaw affects multiple release branches including coder before 2.29.21, 2.30.x before 2.34.12, 2.35.x before 2.35.9, and 2.36.x before 2.36.7. The core technical deficiency lies in the POST /api/v2/workspaceagents/google-instance-identity endpoint, which is responsible for authenticating new workspace agents by validating JSON Web Tokens (JWTs) issued by Google Cloud metadata services. In a secure implementation, an application must verify that the audience claim within the JWT matches its own expected identifier to ensure the token was intended specifically for it. However, in these vulnerable versions of Coder, this validation step is entirely omitted or incorrectly implemented. This oversight allows any valid GCE instance-identity JWT to be accepted regardless of which relying party originally requested it.
The operational impact of this flaw is severe and directly facilitates unauthorized access through token replay attacks. An attacker who has compromised a Google Cloud environment or gained the ability to mint identity tokens can exploit this misconfiguration by obtaining an unexpired format=full identity token that was issued for a different relying party. By submitting this stolen JWT to the vulnerable Coder endpoint, the attacker can successfully authenticate as a workspace agent associated with any target instance. Upon successful authentication, the system issues a session token to the attacker. This session token grants full administrative control over the targeted workspace environment and remains valid until the next scheduled build of that workspace, providing a persistent foothold for further exploitation or data exfiltration.
This vulnerability aligns closely with CWE-287 Improper Authentication because it involves the failure to properly verify the identity of an entity during authentication processes. Furthermore, from a threat modeling perspective consistent with MITRE ATT&CK techniques, this scenario exemplifies T1550 Use Alternate Authentication Credentials and specifically leverages token replay mechanisms similar to those described in T1498 Network Denial of Service or lateral movement via stolen credentials. The ability to reuse tokens intended for other services highlights a fundamental breakdown in the principle of least privilege and strict audience validation required for secure federated identity systems.
To mitigate this risk, organizations must immediately upgrade Coder to version 2.37.4 or later where the audience claim validation has been corrected. For environments that cannot be upgraded instantly due to operational constraints, network-level controls such as firewall rules restricting access to the /api/v2/workspaceagents/google-instance-identity endpoint should be implemented to limit exposure. Additionally, auditing Google Cloud IAM policies and monitoring for unusual JWT issuance patterns can help detect potential exploitation attempts before they result in full workspace compromise. Regular rotation of service account keys and strict enforcement of audience claims in all identity-aware applications are essential best practices to prevent similar authentication bypasses in the future.