Coder EUVD-2026-112392

Only deployments running workspaces on Google Compute Engine that use GCP instance-identity authentication for agents (auth mode other than token) are affected. The attacker must already possess a genuine, unexpired GCE identity token that uses format=full and was minted for a different audience/relying party, sourced from a VM that backs an agent on that workspace's latest build. Limiting factors: tokens cannot be forged because Google's signature and expiry are still verified; the identity token's lifetime is roughly one hour, so the window to replay is short; impact is scoped to a single workspace agent's session token (valid only until the next workspace build); and deployments using format=standard tokens for third-party services or token authentication are not exploitable.

This is a credible but conditional authentication-bypass (confused-deputy, CWE-441) in Coder's GCP instance-identity agent endpoint, confirmed by the vendor GHSA-24vh-q7rg-243w advisory and the VulnCheck advisory. The supplied CVSS 4.0 vector (8.3/High) reads AV:N/AC:L/AT:P/PR:N/UI:N with VC:H/VI:L - network-reachable, no privileges or user interaction, but carrying an explicit Attack Requirement (AT:P) that mirrors the real prerequisite: the attacker must first obtain a genuine, unexpired format=full GCE identity token minted for another relying party. The vuln.today decision label is 'this_week', consistent with a serious issue that is not an active-exploitation emergency. No CISA KEV listing and no EPSS score are present in the input, and no public exploit code is referenced (the two references are vendor/coordinator advisories, not PoC); so there is no confirmed active exploitation. The gating factor is token acquisition, not endpoint access - the endpoint still verifies Google's signature and expiry, so tokens cannot be forged, and the vendor states impact is limited to a single agent's credential. Net: a real, prioritize-this-week issue for the specific affected configuration rather than a mass-exploitable internet-wide threat; the AT:P/token-leak dependency meaningfully lowers real-world likelihood versus the raw score.

An attacker obtains a valid, unexpired format=full GCE instance-identity token that was minted for a different relying party - for example from VM logs, a proxy, or a third-party service that legitimately receives such tokens - from a VM backing a Coder agent on its workspace's latest build. They replay that token to POST /api/v2/workspaceagents/google-instance-identity, and because the endpoint never checks the audience (aud) claim, it returns that workspace agent's session token, which stays valid until the workspace's next build (well beyond the token's ~1-hour life). No public exploit code is identified in the provided data.