https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 09 Oct 2026 17:57:25 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-262513 EUVD-2026-262513 https://cve.radiocsirt.org/vuln/euvd-2026-262513 https://cve.radiocsirt.org/vuln/fkie_cve-2025-66411 <p>Coder allows organizations to provision remote development environments via Terraform. Prior to 2.26.5, 2.27.7, and 2.28.4, Workspace Agent manifests containing sensitive values were logged in plaintext unsanitized. An attacker with limited local access to the Coder Workspace (VM, K8s Pod etc.) or a third-party system (SIEM, logging stack) could access those logs. This vulnerability is fixed in 2.26.5, 2.27.7, and 2.28.4.</p> <p>Coder allows organizations to provision remote development environments via Terraform. Prior to 2.26.5, 2.27.7, and 2.28.4, Workspace Agent manifests containing sensitive values were logged in plaintext unsanitized. An attacker with limited local access to the Coder Workspace (VM, K8s Pod etc.) or a third-party system (SIEM, logging stack) could access those logs. This vulnerability is fixed in 2.26.5, 2.27.7, and 2.28.4.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-66411 https://cve.radiocsirt.org/vuln/ghsa-jf75-p25m-pw74 <p><strong>Affected:</strong> Go: github.com/coder/coder/v2</p> <p>## Summary Workspace Agent manifests containing sensitive values were logged in plaintext unsanitized</p> <p>## Details By default Workspace Agent logs are redirected to [stderr](https://linux.die.net/man/3/stderr) https://github.com/coder/coder/blob/a8862be546f347c59201e2219d917e28121c0edb/cli/agent.go#L432-L439</p> <p>[Workspace Agent Manifests](https://coder.com/docs/reference/agent-api/schemas#agentsdkmanifest) containing sensitive environment variables were logged insecurely https://github.com/coder/coder/blob/7beb95fd56d2f790502e236b64906f8eefb969bd/agent/agent.go#L1090</p> <p>An attacker with limited local access to the Coder Workspace (VM, K8s Pod etc.) or a third-party system ([SIEM](https://csrc.nist.gov/glossary/term/security_information_and_event_management_tool), logging stack) could access those logs</p> <p>This behavior opened room for unauthorized access and privilege escalation</p> <p>## Impact Impact varies depending on the environment variables set in a given workspace</p> <p>## Patches [Fix](https://github.com/coder/coder/commit/e2a46393fce40bc630df3293c1ee66a596277289) was released &amp; backported: - https://github.com/coder/coder/releases/tag/v2.28.4 - https://github.com/coder/coder/releases/tag/v2.27.7 - https://github.com/coder/coder/releases/tag/v2.26.5</p> <p>## Workarounds One potential workaround is to disable Workspace Agent Logs by setting following configuration option `CODER_AGENT_LOGGING_HUMAN=/dev/null` &gt; platform operators are advised to upgrade their deployments</p> <p><strong>Affected:</strong> Go: github.com/coder/coder/v2</p> <p>## Summary Workspace Agent manifests containing sensitive values were logged in plaintext unsanitized</p> <p>## Details By default Workspace Agent logs are redirected to [stderr](https://linux.die.net/man/3/stderr) https://github.com/coder/coder/blob/a8862be546f347c59201e2219d917e28121c0edb/cli/agent.go#L432-L439</p> <p>[Workspace Agent Manifests](https://coder.com/docs/reference/agent-api/schemas#agentsdkmanifest) containing sensitive environment variables were logged insecurely https://github.com/coder/coder/blob/7beb95fd56d2f790502e236b64906f8eefb969bd/agent/agent.go#L1090</p> <p>An attacker with limited local access to the Coder Workspace (VM, K8s Pod etc.) or a third-party system ([SIEM](https://csrc.nist.gov/glossary/term/security_information_and_event_management_tool), logging stack) could access those logs</p> <p>This behavior opened room for unauthorized access and privilege escalation</p> <p>## Impact Impact varies depending on the environment variables set in a given workspace</p> <p>## Patches [Fix](https://github.com/coder/coder/commit/e2a46393fce40bc630df3293c1ee66a596277289) was released &amp; backported: - https://github.com/coder/coder/releases/tag/v2.28.4 - https://github.com/coder/coder/releases/tag/v2.27.7 - https://github.com/coder/coder/releases/tag/v2.26.5</p> <p>## Workarounds One potential workaround is to disable Workspace Agent Logs by setting following configuration option `CODER_AGENT_LOGGING_HUMAN=/dev/null` &gt; platform operators are advised to upgrade their deployments</p> https://cve.radiocsirt.org/vuln/ghsa-jf75-p25m-pw74