Skip to content
OpenAdvisories
High · 7.8 CVE-2025-66411 EUVD-2025-201015GHSA-jf75-p25m-pw74GO-2025-4182

Coder logged sensitive objects unsanitized

Published Dec 3, 2025 · Updated Dec 3, 2025 · Assigned by GitHub_M

Vendor: coder Product: coder Package: github.com/coder/coder Package: github.com/coder/coder/v2 Ecosystem: Go

Description

Coder allows organizations to provision remote development environments via Terraform. Prior to 2.26.5, 2.27.7, and 2.28.4, Workspace Agent manifests containing sensitive values were logged in plaintext unsanitized. An attacker with limited local access to the Coder Workspace (VM, K8s Pod etc.) or a third-party system (SIEM, logging stack) could access those logs. This vulnerability is fixed in 2.26.5, 2.27.7, and 2.28.4.

Affected products

VendorProductAffectedFixed
coder coder >= 2.28.0, < 2.28.4, >= 2.27.0, < 2.27.7, < 2.26.5 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP6 govulncheck-vulndb 0.0.20251209T172047-150000.1.127.1 SUSE-SU-2025:4395-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Leap 16.0 govulncheck-vulndb 0.0.20260723T184607-160000.1.1 openSUSE-SU-2026:21483-1
openSUSE Leap 15.6 govulncheck-vulndb 0.0.20251209T172047-150000.1.127.1 SUSE-SU-2025:4395-1

Affected packages

EcosystemPackageAffectedFixedRecord
Go github.com/coder/coder all versions — GO-2025-4182
Go github.com/coder/coder/v2 < 2.26.5 2.26.5 GHSA-jf75-p25m-pw74
Go github.com/coder/coder/v2 >= 2.27.0, < 2.27.7 2.27.7 GHSA-jf75-p25m-pw74
Go github.com/coder/coder/v2 >= 2.28.0, < 2.28.4 2.28.4 GHSA-jf75-p25m-pw74
Go github.com/coder/coder/v2 < 2.26.5 · >= 2.27.0, < 2.27.7 · >= 2.28.0, < 2.28.4 2.26.5, 2.27.7, 2.28.4 GO-2025-4182

Advisories 2

References