CVE-2025-66411: Coder logged sensitive objects unsanitized
Summary Workspace Agent manifests containing sensitive values were logged in plaintext unsanitized
Details By default Workspace Agent logs are redirected to stderr https://github.com/coder/coder/blob/a8862be546f347c59201e2219d917e28121c0edb/cli/agent.go#L432-L439
Workspace Agent Manifests containing sensitive environment variables were logged insecurely https://github.com/coder/coder/blob/7beb95fd56d2f790502e236b64906f8eefb969bd/agent/agent.go#L1090
An attacker with limited local access to the Coder Workspace (VM, K8s Pod etc.) or a third-party system (SIEM, logging stack) could access those logs
This behavior opened room for unauthorized access and privilege escalation
Impact Impact varies depending on the environment variables set in a given workspace
Patches Fix was released & backported: - https://github.com/coder/coder/releases/tag/v2.28.4 - https://github.com/coder/coder/releases/tag/v2.27.7 - https://github.com/coder/coder/releases/tag/v2.26.5
Workarounds One potential workaround is to disable Workspace Agent Logs by setting following configuration option CODERAGENTLOGGINGHUMAN=/dev/null platform operators are advised to upgrade their deployments
Other sources
Coder allows organizations to provision remote development environments via Terraform. Prior to 2.26.5, 2.27.7, and 2.28.4, Workspace Agent manifests containing sensitive values were logged in plaintext unsanitized. An attacker with limited local access to the Coder Workspace (VM, K8s Pod etc.) or a third-party system (SIEM, logging stack) could access those logs. This vulnerability is fixed in 2.26.5, 2.27.7, and 2.28.4.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-66411?
CVE-2025-66411 is classified as a high severity vulnerability due to the exposure of sensitive values in plaintext logs.
How do I fix CVE-2025-66411?
To fix CVE-2025-66411, upgrade to a version of Workspace Agent that is 2.28.4 or later, or to 2.27.7 and ensure that sensitive data is appropriately sanitized before logging.
What versions are affected by CVE-2025-66411?
CVE-2025-66411 affects Workspace Agent versions from 2.27.0 to 2.28.4 and below 2.26.5.
What type of data is affected by CVE-2025-66411?
CVE-2025-66411 affects sensitive values that are logged in plaintext without proper sanitation.
Is CVE-2025-66411 exploitable in all environments?
CVE-2025-66411 is potentially exploitable in environments where Workspace Agent logging is enabled and monitored.