CVE-2025-66411: Github.com/coder/coder/v2 Coder Logs Sensitive Objects Unsanitized Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-jf75-p25m-pw74",
  "modified" : "2025-12-04T16:22:37Z",
  "published" : "2025-12-03T16:28:36Z",
  "aliases" : [ "CVE-2025-66411" ],
  "summary" : "Coder logs sensitive objects unsanitized",
  "details" : "## Summary\nWorkspace Agent manifests containing sensitive values were logged in plaintext unsanitized\n\n## Details\nBy default Workspace Agent logs are redirected to [stderr](https://linux.die.net/man/3/stderr)\nhttps://github.com/coder/coder/blob/a8862be546f347c59201e2219d917e28121c0edb/cli/agent.go#L432-L439\n\n[Workspace Agent Manifests](https://coder.com/docs/reference/agent-api/schemas#agentsdkmanifest) containing sensitive environment variables were logged insecurely\nhttps://github.com/coder/coder/blob/7beb95fd56d2f790502e236b64906f8eefb969bd/agent/agent.go#L1090\n\nAn attacker with limited local access to the Coder Workspace (VM, K8s Pod etc.) or a third-party system ([SIEM](https://csrc.nist.gov/glossary/term/security_information_and_event_management_tool), logging stack) could access those logs\n\nThis behavior opened room for unauthorized access and privilege escalation\n\n## Impact\nImpact varies depending on the environment variables set in a given workspace\n\n## Patches\n[Fix](https://github.com/coder/coder/commit/e2a46393fce40bc630df3293c1ee66a596277289) was released & backported:\n- https://github.com/coder/coder/releases/tag/v2.28.4\n- https://github.com/coder/coder/releases/tag/v2.27.7\n- https://github.com/coder/coder/releases/tag/v2.26.5\n\n## Workarounds\nOne potential workaround is to disable Workspace Agent Logs by setting following configuration option\n`CODER_AGENT_LOGGING_HUMAN=/dev/null` \n> platform operators are advised to upgrade their deployments",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/coder/coder/v2"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "2.26.5"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/coder/coder/v2"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "2.27.0"
      }, {
        "fixed" : "2.27.7"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/coder/coder/v2"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "2.28.0"
      }, {
        "fixed" : "2.28.4"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/coder/coder/security/advisories/GHSA-jf75-p25m-pw74"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2025-66411"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/coder/coder/pull/20968"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/coder/coder/commit/06c6abbe0935f9213c1588add60a396da5762e1c"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/coder/coder/commit/a75205a559211c8aa494b1a16750d114b263f24a"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/coder/coder/commit/e2a46393fce40bc630df3293c1ee66a596277289"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/coder/coder"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/coder/coder/releases/tag/v2.26.5"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/coder/coder/releases/tag/v2.27.7"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/coder/coder/releases/tag/v2.28.4"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-532" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2025-12-03T16:28:36Z",
    "nvd_published_at" : "2025-12-03T20:16:26Z"
  }
}