CVE-2025-66411

Published: Dec 3, 2025Modified: Jun 17, 2026

5.5

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability: 1.8 / Impact: 3.6

Source: NVD

Description

Coder allows organizations to provision remote development environments via Terraform. Prior to 2.26.5, 2.27.7, and 2.28.4, Workspace Agent manifests containing sensitive values were logged in plaintext unsanitized. An attacker with limited local access to the Coder Workspace (VM, K8s Pod etc.) or a third-party system (SIEM, logging stack) could access those logs. This vulnerability is fixed in 2.26.5, 2.27.7, and 2.28.4.

Affected (3)

Products: Coder: Coder

1 product

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Coder Coder	Before 2.26.5
Coder Coder	From 2.27.0 to 2.27.7
Coder Coder	From 2.28.0 to 2.28.4

Related CWEs

Insertion of Sensitive Information into Log File

Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information.

References (5)

https://github.com/coder/coder/commit/e2a46393fce40bc630df3293c1ee66a596277289

Source: security-advisories@github.com

Patch

https://github.com/coder/coder/releases/tag/v2.26.5

Source: security-advisories@github.com

ProductRelease Notes

https://github.com/coder/coder/releases/tag/v2.27.7

Source: security-advisories@github.com

ProductRelease Notes

https://github.com/coder/coder/releases/tag/v2.28.4

Source: security-advisories@github.com

ProductRelease Notes

https://github.com/coder/coder/security/advisories/GHSA-jf75-p25m-pw74

Source: security-advisories@github.com

ExploitPatchVendor Advisory

Timeline

No history available yet.