CVE-2026-118687

The record

Coder before 2.29.21, 2.30.0 before 2.34.12, 2.35.0 before 2.35.9, 2.36.0 before 2.36.7, and 2.37.0 before 2.37.4 does not validate the audience claim of GCE instance-identity JWTs at the POST /api/v2/workspaceagents/google-instance-identity endpoint. Attackers who obtain an unexpired format=full identity token minted for another relying party can replay it to obtain that workspace agent's session token, which remains valid until the workspace's next build.

Affected packages

Related vulnerabilities

• CVE-2026-67077 HCL BigFix AEX is affected by a Server-Side Request Forgery vulnerability, which could… CWE-441
• CVE-2026-114612 LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. CWE-441
• CVE-2026-114478 Insufficient preservation of the original sender in the forwarding of Progressive Robot… CWE-441
• CVE-2026-101897 Angular is a development platform for building mobile and desktop web applications using… CWE-441
• CVE-2026-83837 Improper access control in Windows Kernel-Mode Drivers allows an authorized attacker to… CWE-441
• CVE-2026-70148 Improper authorization in Windows Broadcast DVR User Service allows an authorized… CWE-441
• CVE-2026-93320 BuildKit may be tricked into performing file actions with special file inodes where… CWE-441
• CVE-2026-101907 Axios is a promise-based HTTP client for the browser and Node.js. CWE-441