Most recent entries from all

EUVD-2026-252172

2026-10-03T21:59:34.655051+00:00

EUVD-2026-252172

fkie_cve-2025-58437

2026-10-03T21:59:34.655086+00:00

Coder allows organizations to provision remote development environments via Terraform. In versions 2.22.0 through 2.24.3, 2.25.0 and 2.25.1, Coder can be compromised through insecure session handling in prebuilt workspaces. Coder automatically generates a session token for a user when a workspace is started. It is automatically exposed via coder_workspace_owner.session_token. Prebuilt workspaces are initially owned by a built-in prebuilds system user. When a prebuilt workspace is claimed, a new session token is generated for the user that claimed the workspace, but the previous session token for the prebuilds user was not expired. Any Coder workspace templates that persist this automatically generated session token are potentially impacted. This is fixed in versions 2.24.4 and 2.25.2.

GHSA-j6xf-jwrj-v5qp — Coder vulnerable to privilege escalation could lead to a cross workspace compromise

2026-10-03T21:59:34.655121+00:00

Affected: Go: github.com/coder/coder/v2

## Summary

Insecure session handling opened room for a privilege escalation scenario in which [prebuilt workspaces](https://coder.com/docs/admin/templates/extending-templates/prebuilt-workspaces) could be compromised by abusing a shared system identity.

## Details

Coder automatically generates a session token for a user when a workspace is started. It is automatically exposed via [`coder_workspace_owner.session_token`](https://registry.terraform.io/providers/coder/coder/latest/docs/data-sources/workspace_owner#session_token-1). Prebuilt workspaces are initially owned by a built-in `prebuilds` system user.

When a prebuilt workspace is claimed, a new session token is generated for the user that claimed the workspace, but the previous session token for the `prebuilds` user was not expired. Any Coder workspace templates that persist this automatically generated session token are potentially impacted.

For example, the [coder-login module](https://github.com/coder/registry/blob/8677e7d52b374b025c4820d09049dc6b008beee8/registry/coder/modules/coder-login/run.sh) allows template authors to automatically configure the coder CLI to be authenticated with the Coder deployment.

This causes a script to be run on workspace startup that runs the command `coder login` using the automatically generated user session token c.f. [https://github.com/coder/registry/blob/8677e7d52b374b025c4820d09049dc6b008beee8/registry/coder/modules/coder-login/main.tf#L23](https://github.com/coder/registry…

openSUSE-SU-2025:15564-1 — govulncheck-vulndb-0.0.20250917T170349-1.1 on GA media

2026-10-03T21:59:34.655178+00:00

govulncheck-vulndb-0.0.20250917T170349-1.1 on GA media