CVE-2025-66411 - CVE House

Back to Database

Status published High CVE-2025-66411

Coder logged sensitive objects unsanitized

7.8 CVSS

Vulnerability Description

Coder allows organizations to provision remote development environments via Terraform. Prior to 2.26.5, 2.27.7, and 2.28.4, Workspace Agent manifests containing sensitive values were logged in plaintext unsanitized. An attacker with limited local access to the Coder Workspace (VM, K8s Pod etc.) or a third-party system (SIEM, logging stack) could access those logs. This vulnerability is fixed in 2.26.5, 2.27.7, and 2.28.4.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-66411

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from coder

View All →

AgentAPI exposed user chat history via a DNS rebinding attack

Coder's privilege escalation vulnerability could lead to a cross workspace compromise

code-server session cookie can be extracted by having user visit specially crafted proxy URL

Coder's OIDC authentication allows email with partially matching domain to register

Cross-site scripting (XSS) vulnerability exists in Coder Code-Server before 3.12.0,...

Affected Vendor

coder

View all reports →

Affected Software

coder

Vulnerable Versions:

>= 2.28.0, < 2.28.4, >= 2.27.0, < 2.27.7, < 2.26.5

Timeline

Official Publish: December 3rd, 2025

Last Modified: December 3rd, 2025

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1005 Data from Local System

T1552 Unsecured Credentials

Credential Access

T1555 Credentials from Password Stores

Credential Access

T1078 Valid Accounts

T1562 Impair Defenses

Defense Evasion