CVE-2026-118687 | Coder up to 2.37.3 Identity Endpoint google-instance-identity authentication replay

October 28, 2026 Yanac

A vulnerability was found in Coder up to 2.29.20/2.34.11/2.35.8/2.36.6/2.37.3 and classified as critical. This affects an unknown part of the file /api/v2/workspaceagents/google-instance-identity of the component Identity Endpoint. The manipulation results in authentication bypass by capture-replay.

This vulnerability is identified as CVE-2026-118687. The attack can be executed remotely. There is not any exploit available.

It is suggested to upgrade the affected component.VulDB Recent EntriesRead More