CVE-2025-66411
published 2025-12-03CVE-2025-66411: Coder allows organizations to provision remote development environments via Terraform. Prior to 2.26.5, 2.27.7, and 2.28.4, Workspace Agent manifests…
PriorityP427medium5.5CVSS 3.1
AVLACLPRLUINSUCHINAN
EPSS
0.23%
14.4th percentile
Coder allows organizations to provision remote development environments via Terraform. Prior to 2.26.5, 2.27.7, and 2.28.4, Workspace Agent manifests containing sensitive values were logged in plaintext unsanitized. An attacker with limited local access to the Coder Workspace (VM, K8s Pod etc.) or a third-party system (SIEM, logging stack) could access those logs. This vulnerability is fixed in 2.26.5, 2.27.7, and 2.28.4.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| coder | coder | < 2.26.5 | 2.26.5 |
| coder | coder | — | — |
| coder | coder | — | — |
| coder | coder | >= 2.27.0 < 2.27.7 | 2.27.7 |
| coder | coder | >= 2.28.0 < 2.28.4 | 2.28.4 |
| github.com | coder_coder_v2 | >= 0 < 2.26.5 | 2.26.5 |
| github.com | coder_coder_v2 | >= 2.27.0 < 2.27.7 | 2.27.7 |
| github.com | coder_coder_v2 | >= 2.28.0 < 2.28.4 | 2.28.4 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Coder logs sensitive objects unsanitized in github.com/coder/coder
osv·2025-12-08
CVE-2025-66411 Coder logs sensitive objects unsanitized in github.com/coder/coder
Coder logs sensitive objects unsanitized in github.com/coder/coder
Coder logs sensitive objects unsanitized in github.com/coder/coder
GHSA
Coder logs sensitive objects unsanitized
ghsa·2025-12-03
CVE-2025-66411 [HIGH] CWE-532 Coder logs sensitive objects unsanitized
Coder logs sensitive objects unsanitized
## Summary
Workspace Agent manifests containing sensitive values were logged in plaintext unsanitized
## Details
By default Workspace Agent logs are redirected to [stderr](https://linux.die.net/man/3/stderr)
https://github.com/coder/coder/blob/a8862be546f347c59201e2219d917e28121c0edb/cli/agent.go#L432-L439
[Workspace Agent Manifests](https://coder.com/docs/reference/agent-api/schemas#agentsdkmanifest) containing sensitive environment variables were logged insecurely
https://github.com/coder/coder/blob/7beb95fd56d2f790502e236b64906f8eefb969bd/agent/agent.go#L1090
An attacker with limited local access to the Coder Workspace (VM, K8s Pod etc.) or a third-party system ([SIEM](https://csrc.nist.gov/glossary/term/security_information_and_event_managem
OSV
Coder logs sensitive objects unsanitized
osv·2025-12-03
CVE-2025-66411 [HIGH] Coder logs sensitive objects unsanitized
Coder logs sensitive objects unsanitized
## Summary
Workspace Agent manifests containing sensitive values were logged in plaintext unsanitized
## Details
By default Workspace Agent logs are redirected to [stderr](https://linux.die.net/man/3/stderr)
https://github.com/coder/coder/blob/a8862be546f347c59201e2219d917e28121c0edb/cli/agent.go#L432-L439
[Workspace Agent Manifests](https://coder.com/docs/reference/agent-api/schemas#agentsdkmanifest) containing sensitive environment variables were logged insecurely
https://github.com/coder/coder/blob/7beb95fd56d2f790502e236b64906f8eefb969bd/agent/agent.go#L1090
An attacker with limited local access to the Coder Workspace (VM, K8s Pod etc.) or a third-party system ([SIEM](https://csrc.nist.gov/glossary/term/security_information_and_event_managem
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/coder/coder/commit/e2a46393fce40bc630df3293c1ee66a596277289https://github.com/coder/coder/releases/tag/v2.26.5https://github.com/coder/coder/releases/tag/v2.27.7https://github.com/coder/coder/releases/tag/v2.28.4https://github.com/coder/coder/security/advisories/GHSA-jf75-p25m-pw74
2025-12-03
Published