Coder: prebuilds system-user session token survives workspace claim and stays valid

Impact

Coder issues a session token into each workspace at start time and exposes it as coder_workspace_owner.session_token. Prebuilt workspaces start as the built-in prebuilds system user; when a real user claims one, a new token is minted but the prebuilds user's old token is never expired. Any template that persists that token leaves a live credential for a privileged built-in account inside a workspace now owned by someone else - whoever can read the workspace filesystem or environment can act as the prebuilds user against the Coder API. On a fleet where Coder hands out GPU dev workspaces to many users, that is a lateral path from one tenant's workspace into workspace provisioning.

Who can reach it

Network, authenticated as a low-privileged Coder user (PR:L) who claims or can read a prebuilt workspace. Only deployments using prebuilt workspaces with templates that persist the session token are affected.

What to do

Upgrade Coder to 2.24.4 or 2.25.2 and restart coderd. Then rotate: revoke the prebuilds user's outstanding tokens and recycle existing prebuilt workspaces, since the upgrade does not invalidate tokens already written into running workspaces. Review templates for anything that writes coder_workspace_owner.session_token to disk and stop persisting it.

References

Related entries

• MinIO (service accounts / STS session policies): The session policy attached to a service account or STS credential isCVE-2025-62506 · MinIO (service accounts / STS session policies)High
• Apache CloudStack: MinIO policies survive bucket deletion, giving a former owner access to a new bucket of the same nameCVE-2025-66467 · Apache CloudStack (MinIO object store policy cleanup on bucket deletion)High
• N-able N-central: Incomplete patch for CVE-2026-18556CVE-2026-18577 · N-able N-centralHigh
• VMware Aria Operations (command injection during assisted migration): An unauthenticated attacker injects commandsCVE-2026-22719 · VMware Aria Operations (command injection during assisted migration)High
• OpenStack glance_store: VMware datastore driver sends authentication headers to an attacker-supplied image location hostCVE-2026-51773 · OpenStack glance_store (VMware datastore driver, _retry_request)High
• Ceph RGW: unsigned x-amz-* headers on presigned URLs are honored, letting a URL holder escalate privilegesCVE-2026-54330 · Ceph Object Gateway (RGW SigV4 presigned-URL header validation)High