Vulnerability · Published Oct 28, 2026 · Assigned by VulnCheck

CVE-2026-118687Coder before 2.29.21, 2.34.12, 2.35.9, 2.36.7, and 2.37.4 Missing Audience Validation in GCP Instance-Identity Authentication

Medium 6.5

In plain English

A medium-severity security flaw in coder from coder. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 8% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.2%top 91.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Coder before 2.29.21, 2.30.0 before 2.34.12, 2.35.0 before 2.35.9, 2.36.0 before 2.36.7, and 2.37.0 before 2.37.4 does not validate the audience claim of GCE instance-identity JWTs at the POST /api/v2/workspaceagents/google-instance-identity endpoint. Attackers who obtain an unexpired format=full identity token minted for another relying party can replay it to obtain that workspace agent's session token, which remains valid until the workspace's next build.

Affected products (as reported)

Vendor	Product	Versions
coder	coder	2.37.0 – before 2.37.4
coder	coder	2.36.0 – before 2.36.7
coder	coder	2.35.0 – before 2.35.9
coder	coder	2.30.0 – before 2.34.12
coder	coder	0 – before 2.29.21

Weakness: CWE-441 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N

References

GitHub Security Advisory (GHSA-24vh-q7rg-243w) vendor-advisory
VulnCheck Advisory: Coder before 2.29.21, 2.34.12, 2.35.9, 2.36.7, and 2.37.4 Missing Audience Validation in GCP Instance-Identity Authentication third-party-advisory