8.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-58437

CVE-2025-58437: Coder vulnerable to privilege escalation could lead to a cross workspace compromise

Summary

Insecure session handling opened room for a privilege escalation scenario in which prebuilt workspaces could be compromised by abusing a shared system identity.

Details

Coder automatically generates a session token for a user when a workspace is started. It is automatically exposed via coder_workspace_owner.session_token. Prebuilt workspaces are initially owned by a built-in prebuilds system user.

When a prebuilt workspace is claimed, a new session token is generated for the user that claimed the workspace, but the previous session token for the prebuilds user was not expired. Any Coder workspace templates that persist this automatically generated session token are potentially impacted.

For example, the coder-login module allows template authors to automatically configure the coder CLI to be authenticated with the Coder deployment.

This causes a script to be run on workspace startup that runs the command coder login using the automatically generated user session token c.f. https://github.com/coder/registry/blob/8677e7d52b374b025c4820d09049dc6b008beee8/registry/coder/modules/coder-login/main.tf#L23

This module was originally written before the inception of the prebuilds feature in Coder, which essentially creates a "pre-warmed" pool of workspaces owned by a particular prebuilds system user.

When this module is invoked on a prebuilt workspace, it causes the Coder CLI inside the workspace to persist the session token for the prebuilds user to disk. Because the module checks if the CLI is authenticated, the script exits early before updating the session token, leaving the Coder CLI authenticated as the user upon claim:

Miggo Vulnerability Database

→

CVE-2025-58437

CVE-2025-58437:

8.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/coder/coder/v2	go	>= 2.22.0, < 2.24.4	2.24.4
github.com/coder/coder/v2	go	>= 2.25.0, < 2.25.2	2.25.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a privilege escalation in Coder's prebuilt workspaces feature. The root cause is the failure to expire the session token of the prebuilds system user after a user claims a prebuilt workspace. This allows the claiming user to potentially retain the privileges of the prebuilds user.

The analysis of the provided patches identified four key functions related to this vulnerability:

github.com/coder/coder/v2/coderd/provisionerdserver.(*server).regenerateSessionToken: This is the central function where the vulnerability manifests. When a workspace is claimed, this function is called to generate a new token for the user. The original implementation did not expire the old token for the prebuilds user. The patch adds logic to explicitly delete the old token, thus fixing the primary vulnerability.
github.com/coder/coder/v2/coderd.(*API).postToken and github.com/coder/coder/v2/coderd.(*API).postAPIKey: These functions were identified as secondary vulnerabilities. They allowed any user, including the compromised prebuilds user, to create new session tokens or API keys. An attacker who gained access to the prebuilds user's token could use these endpoints to create more credentials for persistence and lateral movement. The patch hardens these functions by preventing system users from creating tokens.
github.com/coder/coder/v2/coderd/database/dbauthz.(*querier).InsertAPIKey: This function at the database authorization layer was also vulnerable. It lacked a check to prevent the prebuilds user from creating API keys. The patch adds a specific check to block the prebuilds user from inserting API keys, providing another layer of defense.

In summary, the exploitation of this vulnerability would involve the regenerateSessionToken function during the workspace claiming process. The other identified functions represent weaknesses that could be exploited by an attacker who has successfully obtained the prebuilds user's token, to escalate their privileges and maintain access.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

8.1

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2025-58437: Coder vulnerable to privilege escalation could lead to a cross workspace compromise

Summary

Details

CVE-2025-58437:

8.1

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Detect and Respond To Threats Faster.

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

Vulnerable functions

Technical Details

8.1

8.1

CVE-2025-58437: Coder vulnerable to privilege escalation could lead to a cross workspace compromise

Summary

Details

Basic Information

Basic Information

Impact

Remediation

Patched versions

8.1

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2025-58437: Coder vulnerable to privilege escalation could lead to a cross workspace compromise

Summary

Details

CVE-2025-58437:

8.1

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Technical Details

8.1

8.1

CVE-2025-58437: Coder vulnerable to privilege escalation could lead to a cross workspace compromise

Summary

Details

Basic Information

Basic Information

Impact

Remediation

Patched versions

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI