Cloudanix VulnDB

CVE-2025-66411

High · 7.8

CVSS

7.8

EPSS

0.2%

Published

Dec 3, 2025

CISA due date

—

The record

Coder allows organizations to provision remote development environments via Terraform. Prior to 2.26.5, 2.27.7, and 2.28.4, Workspace Agent manifests containing sensitive values were logged in plaintext unsanitized. An attacker with limited local access to the Coder Workspace (VM, K8s Pod etc.) or a third-party system (SIEM, logging stack) could access those logs. This vulnerability is fixed in 2.26.5, 2.27.7, and 2.28.4.

Affected packages

Ecosystem Package Introduced Fixed
Go github.com/coder/coder 0 No fix
Go github.com/coder/coder/v2 0 2.26.5
Go github.com/coder/coder/v2 2.27.0 2.27.7
Go github.com/coder/coder/v2 2.28.0 2.28.4
SUSE:Linux Enterprise Module for Package Hub 15 SP6 govulncheck-vulndb 0 0.0.20251209T172047-150000.1.127.1
go github.com/coder/coder/v2 2.27.0 2.27.7
go github.com/coder/coder/v2 2.28.0 2.28.4
openSUSE:Leap 15.6 govulncheck-vulndb 0 0.0.20251209T172047-150000.1.127.1

Related vulnerabilities