What happened
CVE-2026-118687 (CVSS 6.5, CWE-441): Coder before 2.29.21, 2.30.0 < 2.34.12, 2.35.0 < 2.35.9, 2.36.0 < 2.36.7, and 2.37.0 < 2.37.4 does not validate the audience claim of GCE instance-identity JWTs at POST /api/v2/workspaceagents/google-instance-identity. An attacker who obtains an unexpired format=full identity token minted for another relying party can replay it to obtain that workspace agent's session token, which stays valid until the workspace's next build.
Why it matters
Coder hosts developer/agent workspaces (including AI coding environments); an unvalidated audience lets a token minted for a different service be replayed to impersonate a workspace agent and take over that workspace's session, exposing code and credentials inside it.
Attack vector
An attacker with an unexpired GCE instance-identity JWT minted for another relying party replays it to the endpoint to obtain a target workspace agent's session token.
Affected systems
Coder (github.com/coder/coder) before 2.29.21 / 2.34.12 / 2.35.9 / 2.36.7 / 2.37.4.
Mitigation
Upgrade Coder to a fixed release (2.29.21 / 2.34.12 / 2.35.9 / 2.36.7 / 2.37.4) per GHSA-24vh-q7rg-243w.