CVEvulnerability
CVE-2025-66411
5.5 MEDIUM
Official page ↗
- Status
- Analyzed
- Published
- 2025-12-03
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 7.8 HIGH — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CVSS 3.1 ([email protected])
- 5.5 MEDIUM — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- Weaknesses
- CWE-532
Description
Coder allows organizations to provision remote development environments via Terraform. Prior to 2.26.5, 2.27.7, and 2.28.4, Workspace Agent manifests containing sensitive values were logged in plaintext unsanitized. An attacker with limited local access to the Coder Workspace (VM, K8s Pod etc.) or a third-party system (SIEM, logging stack) could access those logs. This vulnerability is fixed in 2.26.5, 2.27.7, and 2.28.4.
Affected configurations
• coder coder (< 2.26.5)
• coder coder (>= 2.27.0 < 2.27.7)
• coder coder (>= 2.28.0 < 2.28.4)
Related
Weakness · CWE (1)
- CWE-532 Insertion of Sensitive Information into Log File weakness
References
- https://github.com/coder/coder/commit/e2a46393fce40bc630df3293c1ee66a596277289 Patch
- https://github.com/coder/coder/releases/tag/v2.26.5 Product, Release Notes
- https://github.com/coder/coder/releases/tag/v2.27.7 Product, Release Notes
- https://github.com/coder/coder/releases/tag/v2.28.4 Product, Release Notes
- https://github.com/coder/coder/security/advisories/GHSA-jf75-p25m-pw74 Exploit, Patch, Vendor Advisory