CVE-2026-118687
Description
A flaw was found in Coder. The application fails to properly validate the audience claim in Google Compute Engine (GCE) instance-identity JSON Web Tokens (JWT) during workspace agent authentication. A remote attacker who obtains an unexpired token issued for another service can replay it to obtain a workspace agent session token, resulting in unauthorized access to the workspace environment.
Statement
This vulnerability has been rated as Moderate because exploitation requires the prerequisite acquisition of an unexpired Google Cloud identity token intended for another relying party. Red Hat products do not distribute or package Coder, meaning standard Red Hat Enterprise Linux and OpenShift environments are not exposed to this flaw. In environments where third-party Coder instances are deployed on Google Compute Engine, the blast radius is constrained to workspace agent sessions until the next workspace build.
Understanding the Weakness (CWE)
Access Control
Technical Impact: Gain Privileges or Assume Identity
Messages sent with a capture-relay attack allow access to resources which are not otherwise accessible without proper authentication.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
