High
Coder logged sensitive objects unsanitized
Type: advisorySources: OSV
Coder allows organizations to provision remote development environments via Terraform. Prior to 2.26.5, 2.27.7, and 2.28.4, Workspace Agent manifests containing sensitive values were logged in plaintext unsanitized. An attacker with limited local access to the Coder Workspace (VM, K8s Pod etc.) or a third-party system (SIEM, logging stack) could access those logs. This vulnerability is fixed in 2.26.5, 2.27.7, and 2.28.4.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2025-66411
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 7 Nov 2026, 03:41 UTC · Revision 1
Source evidence
Coder allows organizations to provision remote development environments via Terraform. Prior to 2.26.5, 2.27.7, and 2.28.4, Workspace Agent manifests containing sensitive values were logged in plaintext unsanitized. An attacker with limited local access to the Coder Workspace (VM, K8s Pod etc.) or a third-party system (SIEM, logging stack) could access those logs. This vulnerability is fixed in 2.26.5, 2.27.7, and 2.28.4.
osv:CVE-2025-66411
Complete source record
{
"id": "1274d7b031dc7bb22d3e70c0121c9d89e9f45214d3eaca71f2a22365d8125833",
"url": "https://osv.dev/vulnerability/CVE-2025-66411",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Coder logged sensitive objects unsanitized",
"summary": "Coder allows organizations to provision remote development environments via Terraform. Prior to 2.26.5, 2.27.7, and 2.28.4, Workspace Agent manifests containing sensitive values were logged in plaintext unsanitized. An attacker with limited local access to the Coder Workspace (VM, K8s Pod etc.) or a third-party system (SIEM, logging stack) could access those logs. This vulnerability is fixed in 2.26.5, 2.27.7, and 2.28.4.",
"evidence": "osv:CVE-2025-66411",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2025-66411",
"aliases": [
"CVE-2025-66411",
"GHSA-jf75-p25m-pw74",
"GO-2025-4182"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/coder/coder",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "a75205a559211c8aa494b1a16750d114b263f24a"
},
{
"introduced": "c0cd32c2c4d583423be4cec2a6f9f30209cbce3b"
},
{
"fixed": "06c6abbe0935f9213c1588add60a396da5762e1c"
},
{
"introduced": "1b1e3cb706b899e0779f1561e088ee8cbd3f6aaf"
},
{
"fixed": "e2a46393fce40bc630df3293c1ee66a596277289"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:coder:coder:*:*:*:*:*:go:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "2.26.5"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:coder:coder:*:*:*:*:*:go:*:*",
"range": [
{
"introduced": "2.27.0"
},
{
"fixed": "2.27.7"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:coder:coder:*:*:*:*:*:go:*:*",
"range": [
{
"introduced": "2.28.0"
},
{
"fixed": "2.28.4"
}
],
"source": "CPE_RANGE"
},
{
"range": [
{
"fixed": "e2a46393fce40bc630df3293c1ee66a596277289"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "a75205a559211c8aa494b1a16750d114b263f24a"
}
],
"source": "REFERENCES_TAG",
"original_tag": "v2.26.5"
},
{
"range": [
{
"fixed": "06c6abbe0935f9213c1588add60a396da5762e1c"
}
],
"source": "REFERENCES_TAG",
"original_tag": "v2.27.7"
},
{
"range": [
{
"fixed": "e2a46393fce40bc630df3293c1ee66a596277289"
}
],
"source": "REFERENCES_TAG",
"original_tag": "v2.28.4"
}
]
}
}
],
"versions": [
"v2.26.4",
"v2.27.6",
"v2.28.3",
"v2.28.2",
"v2.27.5",
"v2.28.1",
"v2.27.4",
"v2.28.0",
"v2.27.3",
"v2.26.3",
"v2.27.2",
"v2.27.1",
"v2.26.2",
"v2.26.1",
"v2.27.0",
"v2.26.0",
"v2.10.0",
"v2.9.0",
"v2.6.0",
"v2.8.0",
"v2.7.1",
"v2.7.0",
"v2.5.1",
"v2.5.0",
"v2.4.0",
"v2.3.3",
"v2.3.2",
"v2.3.1",
"v2.3.0",
"v2.2.1",
"v2.1.5",
"v2.1.4",
"v2.1.3",
"v2.1.2",
"v2.1.1",
"v2.0.2",
"v0.27.1",
"v0.27.0",
"v0.26.2",
"v0.26.1",
"v0.26.0",
"v0.25.0",
"v0.24.1",
"v0.24.0",
"v0.23.7",
"v0.23.6",
"v0.23.5",
"v0.23.4",
"v0.23.3",
"v0.23.2",
"v0.23.1",
"v0.23.0",
"v0.22.2",
"v0.22.1",
"v0.22.0",
"v0.21.3",
"v0.21.2",
"v0.21.1",
"v0.21.0",
"v0.20.1",
"v0.20.0",
"v0.19.2",
"v0.19.1",
"v0.19.0",
"v0.18.1",
"v0.18.0",
"v0.17.4",
"v0.17.3",
"v0.17.2",
"v0.17.1",
"v0.17.0",
"v0.16.0",
"v0.15.3",
"v0.15.2",
"v0.15.1",
"v0.15.0",
"v0.14.3",
"v0.14.2",
"v0.14.1",
"v0.14.0",
"v0.13.6",
"v0.13.5",
"v0.13.4",
"v0.13.3",
"v0.13.2",
"v0.13.1",
"v0.13.0",
"v0.12.9",
"v0.12.8",
"v0.12.7",
"v0.12.6",
"v0.12.5",
"v0.12.4",
"v0.12.3",
"v0.12.2",
"v0.12.1",
"v0.12.0",
"v0.11.0",
"v0.10.2",
"v0.10.1",
"v0.10.0",
"rm",
"v0.9.10",
"v0.9.9",
"v0.9.8",
"v0.9.7",
"v0.9.6",
"v0.9.5",
"v0.9.4",
"v0.9.3",
"v0.9.2",
"v0.9.1",
"v0.9.0",
"v0.8.15",
"v0.8.14",
"v0.8.13",
"v0.8.12",
"v0.8.11",
"v0.8.10",
"v0.8.9",
"v0.8.8",
"v0.8.7",
"v0.8.6",
"v0.8.5",
"v0.8.4",
"v0.8.3",
"v0.8.2",
"v0.8.1",
"v0.8.0",
"v0.7.12",
"v0.7.11",
"v0.7.10",
"v0.7.9",
"v0.7.8",
"v0.7.7",
"v0.7.6",
"v0.7.5",
"v0.7.4",
"v0.7.3",
"v0.7.2",
"v0.7.1",
"v0.7.0",
"v0.6.6",
"v0.6.5",
"v0.6.4",
"v0.6.3",
"v0.6.2",
"v0.6.1",
"v0.6.0",
"v0.5.11",
"v0.5.10",
"v0.5.9",
"v0.5.8",
"v0.5.7",
"v0.5.6",
"v0.5.5",
"v0.5.4",
"v0.5.3",
"v0.5.2",
"v0.5.1",
"v0.5.0",
"v0.4.4",
"v0.4.3",
"v0.4.2",
"v0.4.1",
"v0.4.0",
"v0.3.5",
"v0.3.4",
"v0.3.3",
"v0.3.2",
"v0.3.1",
"v0.3.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-66411.json"
}
}
],
"modified": "2026-10-28T02:30:49.447248481Z",
"provider": "osv",
"references": [
"https://github.com/coder/coder/releases/tag/v2.26.5",
"https://github.com/coder/coder/releases/tag/v2.27.7",
"https://github.com/coder/coder/releases/tag/v2.28.4",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66411.json",
"https://github.com/coder/coder/security/advisories/GHSA-jf75-p25m-pw74",
"https://nvd.nist.gov/vuln/detail/CVE-2025-66411",
"https://github.com/coder/coder/commit/e2a46393fce40bc630df3293c1ee66a596277289"
],
"provider_metadata": {
"cwe_ids": [
"CWE-532"
],
"cna_assigner": "GitHub_M",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66411.json"
}
},
"related_cves": [
{
"value": "CVE-2025-66411",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 517838,
"published_at": "2025-12-03T19:25:24.207+00:00"
}