CVE-2025-66411
High
Description
Coder allows organizations to provision remote development environments via Terraform. Prior to 2.26.5, 2.27.7, and 2.28.4, Workspace Agent manifests containing sensitive values were logged in plaintext unsanitized. An attacker with limited local access to the Coder Workspace (VM, K8s Pod etc.) or a third-party system (SIEM, logging stack) could access those logs. This vulnerability is fixed in 2.26.5, 2.27.7, and 2.28.4.
SeverityHigh
CVSS7.8
Exploit probability—
ProductCoder
PublishedDec 3, 2025
First seenDec 3, 2025
Weakness typeCWE-532CWE-532
How to fix
Update
- coder coder2.26.5, 2.27.7, 2.28.4 or later
- github.com/coder/coder/v22.26.5, 2.27.7, 2.28.4 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| coder coder | v < 2.26.5, 2.27.0 ≤ v < 2.27.7, 2.28.0 ≤ v < 2.28.4 | 2.26.5, 2.27.7, 2.28.4 |
| github.com/coder/coder/v2Go | v < 2.26.5, 2.27.0 ≤ v < 2.27.7, 2.28.0 ≤ v < 2.28.4 | 2.26.5, 2.27.7, 2.28.4 |
| github.com/coder/coderGo | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.