{"id":"CVE-2025-58437","aliases":["GHSA-j6xf-jwrj-v5qp","GO-2025-3938"],"url":"https://o3.security/vulnerability/CVE-2025-58437","summary":"Coder's privilege escalation vulnerability could lead to a cross workspace compromise","details":"## Summary\n\nInsecure session handling opened room for a privilege escalation scenario in which [prebuilt workspaces](https://coder.com/docs/admin/templates/extending-templates/prebuilt-workspaces) could be compromised by abusing a shared system identity.\n\n## Details\n\nCoder automatically generates a session token for a user when a workspace is started. It is automatically exposed via [`coder_workspace_owner.session_token`](https://registry.terraform.io/providers/coder/coder/latest/docs/data-sources/workspace_owner#session_token-1). Prebuilt workspaces are initially owned by a built-in `prebuilds` system user. \n\nWhen a prebuilt workspace is claimed, a new session token is generated for the user that claimed the workspace, but the previous session token for the `prebuilds` user was not expired. Any Coder workspace templates that persist this automatically generated session token are potentially impacted. \n\nFor example, the [coder-login module](https://github.com/coder/registry/blob/8677e7d52b374b025c4820d09049dc6b008beee8/registry/coder/modules/coder-login/run.sh) allows template authors to automatically configure the coder CLI to be authenticated with the Coder deployment.\n\nThis causes a script to be run on workspace startup that runs the command `coder login` using the automatically generated user session token c.f. [https://github.com/coder/registry/blob/8677e7d52b374b025c4820d09049dc6b008beee8/registry/coder/modules/coder-login/main.tf#L23](https://github.com/coder/registry/blob/8677e7d52b374b025c4820d09049dc6b008beee8/registry/coder/modules/coder-login/main.tf#L23)\n\nThis module was originally written before the inception of the [prebuilds](https://coder.com/docs/admin/templates/extending-templates/prebuilt-workspaces) feature in Coder, which essentially creates a \"pre-warmed\" pool of workspaces owned by a particular `prebuilds` system user.\n\nWhen this module is invoked on a prebuilt workspace, it causes the Coder CLI inside the workspace to persist the session token for the `prebuilds` user to disk. Because the `coder-login` module checks if the CLI is authenticated, the script exits early before updating the session token, leaving the Coder CLI authenticated as the `prebuilds`user upon claim:\n\n## Impact\n\n> Important: **Deployments that have never utilized the [prebuilds](https://coder.com/docs/admin/templates/extending-templates/prebuilt-workspaces) feature are not affected by this vulnerability.**\n\n\nThis vulnerability requires a previously authenticated user to claim a prebuilt workspace from a template configured to store the prebuilds user session token as described above.\n\nThe `prebuilds` user has no specific roles, so its credential has the same level of access as a regular member user, meaning a user with the `prebuilds` user's credential can move laterally to any other prebuilt workspace, or create new workspaces as the `prebuilds` user.\n\nThis means that a malicious authenticated actor can potentially execute code on other workspaces owned by the `prebuilds` user and potentially access information of other users once they claim a previously poisoned workspace.\n\n\n## Remediation\n\nFixed in https://github.com/coder/coder/pull/19667\n\nNote that prebuilt workspaces claimed previous to the fix may have been affected by this vulnerability. It is recommended that users re-create their workspace if it was created from a prebuild.\n\nTo identify potentially affected workspaces, run the following SQL query against the Coder database:\n\n```sql\nSELECT w.id, w.name, w.owner_id, u.email\nFROM workspaces w\nLEFT JOIN users u ON u.id = w.owner_id\nWHERE w.owner_id <> 'c42fdf75-3097-471c-8c33-fb52454d81c0'::uuid\n  AND NOT w.deleted\n  AND EXISTS (\n    SELECT 1\n    FROM workspace_builds AS wb\n    WHERE wb.workspace_id = w.id\n      AND wb.initiator_id = 'c42fdf75-3097-471c-8c33-fb52454d81c0'::uuid\n  );\n```\n\n> Previous manually created tokens for the prebuilds user are left as-is. You may wish to review these via `coder tokens list --all`\n\n---\n\n[Premium license](https://coder.com/docs/admin/licensing) customers can also take advantage of the [audit logs](https://coder.com/docs/admin/security/audit-logs) feature to query actions performed by the `prebuilds` user.\n\nFollowing [filter](https://coder.com/docs/admin/security/audit-logs#how-to-filter-audit-logs) can be used to verify if no [API keys](https://coder.com/docs/reference/api/users#create-token-api-key) were created by the `prebuilds` user\n> would indicate a potentially malicious action aimed at achieving [persistence](https://attack.mitre.org/tactics/TA0003/)\n```\nusername:prebuilds resource_type:api_key\n```\n\nFollowing [filter](https://coder.com/docs/admin/security/audit-logs#how-to-filter-audit-logs) can be used to list all *write* operations performed by the `prebuilds` user (including failed attempts to update various settings)\n```\nusername:prebuilds action:write\n```\n\n### Patched versions\n- [2.24.4](https://github.com/coder/coder/releases/tag/v2.24.4)\n- [2.25.2](https://github.com/coder/coder/releases/tag/v2.25.2)\n- [2.26.0](https://github.com/coder/coder/releases/tag/v2.26.0)","published":"2025-09-06T02:30:08.378Z","modified":"2026-08-12T03:51:34.923320932Z","cvss":{"score":8.1,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"},"epss":{"score":0.00374,"percentile":0.30089,"asOf":"2026-08-24"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Go","name":"github.com/coder/coder/v2","fixedVersion":"2.24.4"},{"ecosystem":"Go","name":"github.com/coder/coder/v2","fixedVersion":"2.25.2"}],"fix":{"url":"https://github.com/coder/coder/commit/06cbb2890f453cd522bb2158a6549afa3419c276","label":"coder/coder@06cbb28"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/58xxx/CVE-2025-58437.json"},{"type":"ADVISORY","url":"https://github.com/coder/coder/security/advisories/GHSA-j6xf-jwrj-v5qp"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-58437"},{"type":"FIX","url":"https://github.com/coder/coder/commit/06cbb2890f453cd522bb2158a6549afa3419c276"},{"type":"FIX","url":"https://github.com/coder/coder/commit/20d67d7d7191a4fd5d36a61c6fc1e23ab59befc0"},{"type":"FIX","url":"https://github.com/coder/coder/commit/ec660907faa0b0eae20fa2ba58ce1733f5f4b35a"},{"type":"FIX","url":"https://github.com/coder/coder/pull/19667"},{"type":"FIX","url":"https://github.com/coder/coder/pull/19668"},{"type":"FIX","url":"https://github.com/coder/coder/pull/19669"},{"type":"PACKAGE","url":"https://github.com/coder/coder"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:34.923320932Z"}}