CVE-2026-118687

Name of the Vulnerable Software and Affected Versions Coder versions prior to 2.29.21 Coder versions 2.30.0 through 2.34.11 Coder versions 2.35.0 through 2.35.8 Coder versions 2.36.0 through 2.36.6 Coder versions 2.37.0 through 2.37.3

Description Failure to validate the audience claim of GCE instance-identity JWTs (JSON Web Tokens) at the 'POST /api/v2/workspaceagents/google-instance-identity' endpoint allows an attacker to replay an unexpired format=full identity token minted for a different relying party. This can lead to the unauthorized acquisition of a workspace agent session token, which remains valid until the next build of the workspace.

Recommendations Update to version 2.29.21 or later. Update to version 2.34.12 or later. Update to version 2.35.9 or later. Update to version 2.36.7 or later. Update to version 2.37.4 or later.