CVE-2026-118687: Coder before 2.29.21, 2.34.12, 2.35.9, 2.36.7, and 2.37.4 Missing Audience Validation in GCP Instance-Identity Authentication
Coder before 2.29.21, 2.30.0 before 2.34.12, 2.35.0 before 2.35.9, 2.36.0 before 2.36.7, and 2.37.0 before 2.37.4 does not validate the audience claim of GCE instance-identity JWTs at the POST /api/v2/workspaceagents/google-instance-identity endpoint. Attackers who obtain an unexpired format=full identity token minted for another relying party can replay it to obtain that workspace agent's session token, which remains valid until the workspace's next build.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
Affected deployments are Coder versions before 2.29.21; 2.30.0 through before 2.34.12; 2.35.0 through before 2.35.9; 2.36.0 through before 2.36.7; and 2.37.0 through before 2.37.4, where GCP instance-identity authentication is used at the workspace-agent endpoint.
What does an attacker need to exploit this issue?
An attacker needs an unexpired, format=full GCE instance-identity JWT that was minted for another relying party. The token can then be replayed to the affected workspace-agent authentication endpoint without audience validation.
What access can exploitation provide?
Successful replay obtains the targeted workspace agent's session token. That session token remains valid until the workspace's next build.
What mitigation is available if a patch cannot be applied immediately?
The provided information does not specify a workaround. Rebuilding the affected workspace ends validity of a session token obtained through exploitation, but this is not described as a preventative mitigation.