CVE-2025-66411
mediumpriority · track · 22EPSS 0.002 · 14 %ileEUUSEPSS · scored 2026-10-27
Coder allows organizations to provision remote development environments via Terraform. Prior to 2.26.5, 2.27.7, and 2.28.4, Workspace Agent manifests containing sensitive values were logged in plaintext unsanitized. An attacker with limited local access to the Coder Workspace (VM, K8s Pod etc.) or a third-party system (SIEM, logging stack) could access those logs. This vulnerability is fixed in 2.26.5, 2.27.7, and 2.28.4.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 5.1–7.8
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (10)
Products and version ranges known to be affected.
advisories (2)
Vendor and ecosystem advisories describing this.
- GHSA-jf75-p25m-pw74Coder logs sensitive objects unsanitized2025-12-03ghsa · osvUS
## Summary Workspace Agent manifests containing sensitive values were logged in plaintext unsanitized ## Details By default Workspace Agent logs are redirected to [stderr](https://linux.die.net/man/3/stderr) https://github.com/coder/coder/blob/a8862be546f347c59201e2219d917e28121c0edb/cli/agent.go#L432-L439 [Workspace Agent Manifests](https://coder.com/docs/reference/agent-api/schemas#agentsdkmanifest) containing sensitive environment variables were logged insecurely https://github.com/coder/coder/blob/7beb95fd56d2f790502e236b64906f8eefb969bd/agent/agent.go#L1090 An attacker with limited local access to the Coder Workspace (VM, K8s Pod etc.) or a third-party system ([SIEM](https://csrc.nist.gov/glossary/term/security_information_and_event_management_tool), logging stack) could access those logs This behavior opened room for unauthorized access and privilege escalation ## Impact Impact varies depending on the environment variables set in a given workspace ## Patches [Fix](https://github.com/coder/coder/commit/e2a46393fce40bc630df3293c1ee66a596277289) was released & backported: - https://github.com/coder/coder/releases/tag/v2.28.4 - https://github.com/coder/coder/releases/tag/v2.27.7 - https://github.com/coder/coder/releases/tag/v2.26.5 ## Workarounds One potential workaround is to disable Workspace Agent Logs by setting following configuration option `CODER_AGENT_LOGGING_HUMAN=/dev/null` > platform operators are advised to upgrade their deployments
- GO-2025-4182Coder logs sensitive objects unsanitized in github.com/coder/coder2025-12-08vendor · osvUS
Coder logs sensitive objects unsanitized in github.com/coder/coder
also known as (5)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (17)
External citations — patches, advisories, analysis.
- https://access.redhat.com/security/cve/cve-2025-66411cnnvd
- https://github.com/coder/coder/commit/e2a46393fce40bc630df3293c1ee66a596277289cnnvd
- https://github.com/coder/coder/releasesPatchcnnvd
- https://github.com/coder/coder/releases/tag/v2.26.5cnnvd
- https://github.com/coder/coder/releases/tag/v2.27.7cnnvd
- https://github.com/coder/coder/releases/tag/v2.28.4cnnvd
- https://github.com/coder/coder/security/advisories/GHSA-jf75-p25m-pw74cnnvd
- https://github.com/coder/coder/commit/e2a46393fce40bc630df3293c1ee66a596277289enisa_euvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan