HIGH🇵🇱 Wersja polska

CVE-2025-66411

CVSS 7.8v3.1pub. 2025-12-03upd. 2026-02-13

Coder allows organizations to provision remote development environments via Terraform. Prior to 2.26.5, 2.27.7, and 2.28.4, Workspace Agent manifests containing sensitive values were logged in plaintext unsanitized. An attacker with limited local access to the Coder Workspace (VM, K8s Pod etc.) or a third-party system (SIEM, logging stack) could access those logs. This vulnerability is fixed in 2.26.5, 2.27.7, and 2.28.4.

CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

  • Coder

    APP
    Coder
    < 2.26.52.27.0 – 2.27.7 (bez)2.28.0 – 2.28.4 (bez)
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2025-58437HIGH8.1ten sam produkt

Coder allows organizations to provision remote development environments via Terraform. In versions 2.22.0 thro...

CVE-2024-27918HIGH8.2ten sam produkt

Coder allows oragnizations to provision remote development environments via Terraform. Prior to versions 2.6.1...

CVE-2026-35454HIGH8.7ten sam vendor

The Code Extension Marketplace is an open-source alternative to the VS Code Marketplace. Prior to 2.4.2, Zip S...

CVE-2023-26114HIGH8.2ten sam vendor

Versions of the package code-server before 4.10.1 are vulnerable to Missing Origin Validation in WebSockets ha...

CVE-2021-3810HIGH7.5ten sam vendor

code-server is vulnerable to Inefficient Regular Expression Complexity