← Vulnerability feed

Vulnerability record · CVE-2025-58437 · published 6 September 2025

CVE-2025-58437: Coder insufficient session expiration vulnerability

Coder · Coder

Coder allows organizations to provision remote development environments via Terraform. In versions 2.22.0 through 2.24.3, 2.25.0 and 2.25.1, Coder can be compromised through insecure session handling in prebuilt workspaces. Coder automatically generates a session token for a user when a workspace is started. It is automatically exposed via coder_workspace_owner.session_token. Prebuilt workspaces are initially owned by a built-in prebuilds system user. When a prebuilt workspace is claimed, a new session token is generated for the user that claimed the workspace, but the previous session token for the prebuilds user was not expired. Any Coder workspace templates that persist this automatically generated session token are potentially impacted. This is fixed in versions 2.24.4 and 2.25.2.

8.1 CVSS 3.1 High EPSS 0.38% · top 70.4% CWE-277 · CWE-277CWE-279 · CWE-279
8.1CVSS 3.1 base score
0.38%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
7References, 1 tagged exploit
17 Jun 2026Last modified by NVD

Description

Coder allows organizations to provision remote development environments via Terraform. In versions 2.22.0 through 2.24.3, 2.25.0 and 2.25.1, Coder can be compromised through insecure session handling in prebuilt workspaces. Coder automatically generates a session token for a user when a workspace is started. It is automatically exposed via coder_workspace_owner.session_token. Prebuilt workspaces are initially owned by a built-in prebuilds system user. When a prebuilt workspace is claimed, a new session token is generated for the user that claimed the workspace, but the previous session token for the prebuilds user was not expired. Any Coder workspace templates that persist this automatically generated session token are potentially impacted. This is fixed in versions 2.24.4 and 2.25.2.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/coder/coder/commit/06cbb2890f453cd522bb2158a6549afa3419c276 Patch
https://github.com/coder/coder/commit/20d67d7d7191a4fd5d36a61c6fc1e23ab59befc0 Patch
https://github.com/coder/coder/commit/ec660907faa0b0eae20fa2ba58ce1733f5f4b35a Patch
https://github.com/coder/coder/pull/19667 Issue Tracking
https://github.com/coder/coder/pull/19668 Issue Tracking
https://github.com/coder/coder/pull/19669 Issue Tracking
https://github.com/coder/coder/security/advisories/GHSA-j6xf-jwrj-v5qp ExploitMitigationVendor Advisory

Track CVE-2025-58437 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.1CVE-2026-46354Coder improper verification of cryptographic signature vulnerabilityCoder allows organizations to provision remote development environments via Terraform. In versions prior tp 2.24.5, 2.29.13, 2.30.8, 2.31.12, 2.32.2,…EPSS 0.32%8.8CVE-2026-44454Coder os command injection vulnerabilityCoder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7 and 2.30.2, the `dotfiles` registry m…EPSS 2.6%8.7CVE-2026-55429Coder insecure direct object reference vulnerabilityCoder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, `UpsertW…EPSS 0.51%8.3CVE-2026-55427Coder injection vulnerabilityCoder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, `coder c…EPSS 0.47%8.2CVE-2026-55428Coder improper authorization vulnerabilityCoder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, the tail…EPSS 0.40%8.2CVE-2024-27918Coder improper input validation vulnerabilityCoder allows oragnizations to provision remote development environments via Terraform. Prior to versions 2.6.1, 2.7.3, and 2.8.4, a vulnerability in …EPSS 0.97%7.4CVE-2026-55436Coder improper certificate validation vulnerabilityCoder allows organizations to provision remote development environments via Terraform. Starting in version 2.30.0 and prior to versions 2.32.7, 2.33.…EPSS 0.26%7.4CVE-2026-55076Coder improper authentication vulnerabilityCoder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, Coder's …EPSS 0.61%

Source: NIST National Vulnerability Database (record CVE-2025-58437), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.