Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-118687— Coder before 2.29.21, 2.34.12, 2.35.9, 2.36.7, and 2.37.4 Missing Audience Validation in GCP Instance-Identity Authentication

Quick assessment

Affected
coder coder
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Coder 2.29.21 之前的版本、2.30.0 至 2.34.12 之间的版本、2.35.0 至 2.35.9 之间的版本、2.36.0 至 2.36.7 之间的版本，以及 2.37.0 至 2.37.4 之间的版本中，POST /api/v2/workspaceagents/google-instance-identity 接口未对 GCE 实例身份 JWT 的受众（audience）声明进行验证。攻击者若获取到为其他依赖方签发且尚未过期的 format=full 身份令牌，便可重放该令牌以获取工作区代

CVSS 6.5 · Medium

Affected Version Matrix 10

VendorProduct Version RangeStatus
coder coder 2.37.0< 2.37.4 affected
2.37.4 unaffected
2.36.0< 2.36.7 affected
2.36.7 unaffected
2.35.0< 2.35.9 affected
2.35.9 unaffected
2.30.0< 2.34.12 affected
2.34.12 unaffected
… +2 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-118687

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Coder before 2.29.21, 2.34.12, 2.35.9, 2.36.7, and 2.37.4 Missing Audience Validation in GCP Instance-Identity Authentication
Source: CVE Program / CVE List V5
Vulnerability Description
Coder before 2.29.21, 2.30.0 before 2.34.12, 2.35.0 before 2.35.9, 2.36.0 before 2.36.7, and 2.37.0 before 2.37.4 does not validate the audience claim of GCE instance-identity JWTs at the POST /api/v2/workspaceagents/google-instance-identity endpoint. Attackers who obtain an unexpired format=full identity token minted for another relying party can replay it to obtain that workspace agent's session token, which remains valid until the workspace's next build.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
未有动机的代理或中间人(混淆代理)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
coder coder 2.37.0 ~ 2.37.4 -
coder coder 2.36.0 ~ 2.36.7 -
coder coder 2.35.0 ~ 2.35.9 -
coder coder 2.30.0 ~ 2.34.12 -
coder coder 0 ~ 2.29.21 -

II. Public POCs for CVE-2026-118687

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-118687

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-118687 (2)

IV. Related Vulnerabilities

Same product: coder
Same vendor: coder
Same weakness: CWE-441