GO-2025-3938: Coder's privilege escalation vulnerability could lead to a cross workspace compromise

Q: Which deployments are affected?

Affected deployments run Coder 2.22.0 through 2.24.3, or 2.25.0 through 2.25.1, and use workspace templates that persist the automatically generated session token exposed through coder_workspace_owner.session_token. The issue involves prebuilt workspaces that are initially owned by the built-in prebuilds system user and later claimed by another user.

Q: What does an attacker need to exploit this issue?

An attacker needs access to the session token generated for the prebuilds system user from an affected template that persists that token. After the prebuilt workspace is claimed, that prior token remains valid instead of expiring, enabling compromise across workspaces.

Q: Are default workspace configurations necessarily vulnerable?

Not necessarily. The issue potentially affects templates that persist the automatically generated coder_workspace_owner.session_token; the provided information does not indicate that every Coder template persists it.

Q: What should be done if immediate patching is not possible?

Identify templates that persist coder_workspace_owner.session_token and stop persisting the automatically generated token where possible. This reduces exposure from retained prebuilds-user session tokens until Coder can be updated.

Q: How can administrators determine whether they may be affected?

Check whether the deployment uses affected Coder versions, has prebuilt workspaces, and has templates that persist coder_workspace_owner.session_token. Claimed prebuilt workspaces are the relevant scenario because the older prebuilds-user token was not expired when a claimant received a new token.

Published Sep 6, 2025

Updated

Coder allows organizations to provision remote development environments via Terraform. In versions 2.22.0 through 2.24.3, 2.25.0 and 2.25.1, Coder can be compromised through insecure session handling in prebuilt workspaces. Coder automatically generates a session token for a user when a workspace is started. It is automatically exposed via coderworkspaceowner.sessiontoken. Prebuilt workspaces are initially owned by a built-in prebuilds system user. When a prebuilt workspace is claimed, a new session token is generated for the user that claimed the workspace, but the previous session token for the prebuilds user was not expired. Any Coder workspace templates that persist this automatically generated session token are potentially impacted. This is fixed in versions 2.24.4 and 2.25.2.

Affected Software

1 affected component

Coder Coder>=2.22.0<=2.24.3, =2.25.0, =2.25.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Coder to a version that resolves this vulnerability.
Fixed in 2.24.4
Upgrade
Upgrade Coder to a version that resolves this vulnerability.
Fixed in 2.25.2

Event History

Sep 6, 2025

CVE Published

via OSV·02:30 AM

Data Sourced

via OSV·02:30 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

Affected deployments run Coder 2.22.0 through 2.24.3, or 2.25.0 through 2.25.1, and use workspace templates that persist the automatically generated session token exposed through coder_workspace_owner.session_token. The issue involves prebuilt workspaces that are initially owned by the built-in prebuilds system user and later claimed by another user.

What does an attacker need to exploit this issue?

An attacker needs access to the session token generated for the prebuilds system user from an affected template that persists that token. After the prebuilt workspace is claimed, that prior token remains valid instead of expiring, enabling compromise across workspaces.

Are default workspace configurations necessarily vulnerable?

Not necessarily. The issue potentially affects templates that persist the automatically generated coder_workspace_owner.session_token; the provided information does not indicate that every Coder template persists it.

What should be done if immediate patching is not possible?

Identify templates that persist coder_workspace_owner.session_token and stop persisting the automatically generated token where possible. This reduces exposure from retained prebuilds-user session tokens until Coder can be updated.

How can administrators determine whether they may be affected?

Check whether the deployment uses affected Coder versions, has prebuilt workspaces, and has templates that persist coder_workspace_owner.session_token. Claimed prebuilt workspaces are the relevant scenario because the older prebuilds-user token was not expired when a claimant received a new token.

GO-2025-3938: Coder's privilege escalation vulnerability could lead to a cross workspace compromise

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are affected?

What does an attacker need to exploit this issue?

Are default workspace configurations necessarily vulnerable?

What should be done if immediate patching is not possible?

How can administrators determine whether they may be affected?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What does an attacker need to exploit this issue?

Are default workspace configurations necessarily vulnerable?

What should be done if immediate patching is not possible?

How can administrators determine whether they may be affected?