Listen to this Post
The vulnerability (CVE-2025-54078) occurs in the Coder platform’s Workspace Agent. By default, the agent redirects its internal logs to the standard error (stderr) stream. Within these logs, the agent’s full manifest data—which can contain sensitive environment variables defined for the workspace—is written without any sanitization or redaction. The insecure logging happens at the code level when the agent starts and marshals its configuration. An attacker with local access to the workspace container, virtual machine, or Kubernetes pod can read these logs from the process. Furthermore, if these logs are aggregated into a third-party system like a SIEM or logging dashboard, an attacker with access to those systems could also retrieve the sensitive data, leading to potential credential theft and privilege escalation.
Platform: Coder
Version: <2.26.5, 2.27.0-2.27.6, 2.28.0-2.28.3
Vulnerability: Information Disclosure
Severity: High
date: 2025-12-03
Prediction: Patched 2025-12-03
What Undercode Say:
Analytics
grep -r "agent.go" /var/log/coder/ cat /proc/[bash]/fd/2
// From agent.go line ~1090
log.Debug(ctx, "agent manifest", slog.F("manifest", manifest))
How Exploit:
Attacker on compromised workspace: journalctl -u coder-agent | grep -A 20 "agent manifest" Or inspect stderr of the agent process directly.
Protection from this CVE
Update to versions 2.26.5, 2.27.7, or 2.28.4. Apply workaround: export CODER_AGENT_LOGGING_HUMAN=/dev/null.
Impact:
Credential exposure, privilege escalation, sensitive data leak.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
