CVE-2026-118687

Coder before 2.29.21, 2.34.12, 2.35.9, 2.36.7, and 2.37.4 Missing Audience Validation in GCP Instance-Identity Authentication

State: Published
Severity: 8.3 High
Published: Oct 28, 2026
Updated: Oct 29, 2026
Reserved: Oct 28, 2026

Read the record on cve.org

Description

Coder before 2.29.21, 2.30.0 before 2.34.12, 2.35.0 before 2.35.9, 2.36.0 before 2.36.7, and 2.37.0 before 2.37.4 does not validate the audience claim of GCE instance-identity JWTs at the POST /api/v2/workspaceagents/google-instance-identity endpoint. Attackers who obtain an unexpired format=full identity token minted for another relying party can replay it to obtain that workspace agent's session token, which remains valid until the workspace's next build.

Scores

CVSS	Score	Vector	Source
4.0	8.3 High	CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N	VulnCheck
3.1	6.5 Medium	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N	VulnCheck

Weaknesses

CWE-441 Unintended Proxy or Intermediary ('Confused Deputy')

Affected Products

Product	Versions
codercoder	2.37.0 to before 2.37.4Affected 2.37.4Not affected
codercoder	2.36.0 to before 2.36.7Affected 2.36.7Not affected
codercoder	2.35.0 to before 2.35.9Affected 2.35.9Not affected
codercoder	2.30.0 to before 2.34.12Affected 2.34.12Not affected
codercoder	before 2.29.21Affected 2.29.21Not affected

References

GitHub Security Advisory (GHSA-24vh-q7rg-243w)vendor-advisory
VulnCheck Advisory: Coder before 2.29.21, 2.34.12, 2.35.9, 2.36.7, and 2.37.4 Missing Audience Validation in GCP Instance-Identity Authenticationthird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.