CVE-2025-66411
📋 TL;DR
CVE-2025-66411 is an information disclosure vulnerability in Coder where sensitive values in Workspace Agent manifests were logged in plaintext without sanitization. Attackers with local access to Coder Workspace environments (VMs, Kubernetes Pods) or third-party logging systems could access these logs containing sensitive data. Organizations using affected Coder versions for remote development environment provisioning are impacted.
💻 Affected Systems
- Coder
📦 What is this software?
Coder by Coder
Coder by Coder
Coder by Coder
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain access to sensitive credentials, API keys, or secrets from logged manifests, leading to lateral movement, privilege escalation, or complete environment compromise.
Likely Case
Internal attackers or compromised systems access sensitive configuration data from logs, potentially enabling further attacks within the development environment.
If Mitigated
With proper access controls and log monitoring, impact is limited to authorized users who already have some level of access to the environment.
🎯 Exploit Status
Exploitation requires access to Coder Workspace environments or logging systems where manifests are logged.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.26.5, 2.27.7, or 2.28.4
Vendor Advisory: https://github.com/coder/coder/security/advisories/GHSA-jf75-p25m-pw74
Restart Required: Yes
Instructions:
1. Identify your Coder version. 2. Upgrade to 2.26.5 if on 2.26.x, 2.27.7 if on 2.27.x, or 2.28.4 if on 2.28.x. 3. Restart Coder services. 4. Verify logs no longer contain sensitive manifest data.
🔧 Temporary Workarounds
Restrict Log Access
linuxImplement strict access controls on log files and logging systems to prevent unauthorized access.
# Set appropriate permissions on log directories
chmod 750 /var/log/coder/
# Configure log rotation to limit retention
Configure logrotate for Coder logs
Disable Sensitive Logging
allConfigure Coder to exclude sensitive manifest data from logs if patching is not immediately possible.
# Modify Coder logging configuration
coder server --log-level=error # Reduce verbosity
# Review and adjust logging configuration files
🧯 If You Can't Patch
- Implement strict access controls on Coder Workspace environments and logging systems
- Monitor and audit access to Coder logs for suspicious activity
🔍 How to Verify
Check if Vulnerable:
Check Coder version and review logs for plaintext sensitive values in Workspace Agent manifests.Check Version:
coder versionVerify Fix Applied:
After patching, verify logs no longer contain sensitive manifest data and confirm version is 2.26.5, 2.27.7, or 2.28.4.📡 Detection & Monitoring
Log Indicators:
- Plaintext sensitive values in Coder logs
- Workspace Agent manifest data in logs
- Unauthorized access attempts to log files
Network Indicators:
- Unusual access patterns to logging systems
- Data exfiltration from log storage
SIEM Query:
source="coder" AND ("Workspace Agent" OR "manifest") AND ("password" OR "secret" OR "key" OR "token")🔗 References
- https://github.com/coder/coder/commit/e2a46393fce40bc630df3293c1ee66a596277289
- https://github.com/coder/coder/releases/tag/v2.26.5
- https://github.com/coder/coder/releases/tag/v2.27.7
- https://github.com/coder/coder/releases/tag/v2.28.4
- https://github.com/coder/coder/security/advisories/GHSA-jf75-p25m-pw74
