PT-2025-48989 · Coder · Coder

Published 2025-12-03 · Updated 2025-12-15 · CVE-2025-66411

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Coder versions prior to 2.26.5 Coder versions prior to 2.27.7 Coder versions prior to 2.28.4

Description Coder enables organizations to set up remote development environments using Terraform. Before versions 2.26.5, 2.27.7, and 2.28.4, Workspace Agent manifests with sensitive data were recorded in logs as plain text without proper sanitization. An attacker with limited local access to the Coder Workspace (VM, K8s Pod, etc.) or a third-party system (SIEM, logging stack) could potentially gain access to these logs.

Recommendations Update to Coder version 2.26.5 or later. Update to Coder version 2.27.7 or later. Update to Coder version 2.28.4 or later.

Exploit

Fix

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

CVE-2025-66411

GHSA-JF75-P25M-PW74

GO-2025-4182

SUSE-SU-2025:4395-1

Affected Products

Coder

References · 57

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66411.json · Exploit
• https://github.com/coder/coder/commit/e2a46393fce40bc630df3293c1ee66a596277289 · Patch
• https://github.com/coder/coder/security/advisories/GHSA-jf75-p25m-pw74 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-66411 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-66411 · Security Note
• https://osv.dev/vulnerability/GO-2025-4182 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:4395-1 · Vendor Advisory
• https://github.com/coder/coder/commit/a75205a559211c8aa494b1a16750d114b263f24a · Note
• https://github.com/coder/coder/releases/tag/v2.27.7 · Note
• https://github.com/coder/coder/commit/06c6abbe0935f9213c1588add60a396da5762e1c · Note
• https://github.com/coder/coder/releases/tag/v2.28.4 · Note
• https://github.com/coder/coder/releases/tag/v2.26.5 · Note
• https://github.com/coder/coder/pull/20968 · Note
• https://suse.com/security/cve/CVE-2025-61729 · Note
• https://suse.com/security/cve/CVE-2017-18871 · Note