CVE-2026-118687 Coder before 2.29.21, 2.30.0 before 2.34.12, 2.35.0 before 2.35.9, 2.36.0 before 2.36.7, and 2.37.0 before 2.37.4 does not validate the audi
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-118687?
CVE-2026-118687 is a high-severity vulnerability in coder, published on 28 Oct 2026.
Official description
Coder before 2.29.21, 2.30.0 before 2.34.12, 2.35.0 before 2.35.9, 2.36.0 before 2.36.7, and 2.37.0 before 2.37.4 does not validate the audience claim of GCE instance-identity JWTs at the POST /api/v2/workspaceagents/google-instance-identity endpoint. Attackers who obtain an unexpired format=full identity token minted for another relying party can replay it to obtain that workspace agent's session token, which remains valid until the workspace's next build.
Weakness: CWE-441
Which versions are affected by CVE-2026-118687?
How do I fix CVE-2026-118687?
No fix has been published for CVE-2026-118687 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-118687 being exploited?
There is no known exploitation of CVE-2026-118687 in the wild and no public exploit code.
Sources
Also known as GHSA-24vh-q7rg-243w, GHSA-j9wc-wg7r-6rm3.