Missing Audience Claim Validation in Coder Product by Coder

CVE-2026-118687

What is CVE-2026-118687?

The Coder platform has a design flaw affecting versions prior to specified updates, where it fails to validate the audience claim in GCP instance-identity JWTs at the POST /api/v2/workspaceagents/google-instance-identity endpoint. This oversight allows malicious actors to replay an unexpired identity token issued for another relying party to gain access to a workspace agent's session token, which remains unrevoked until the next build operation of the workspace. Users are advised to update to the latest versions to mitigate this risk.

References