CVE-2025-58437 is a high-severity improper privilege management vulnerability in github.com/coder/coder/v2 (go), affecting versions >= 2.22.0, < 2.24.4. It is fixed in 2.24.4, 2.25.2.
Summary Insecure session handling opened room for a privilege escalation scenario in which prebuilt workspaces could be compromised by abusing a shared system identity. Details Coder automatically generates a session token for a user when a workspace is started. It is automatically exposed via coderworkspaceowner.sessiontoken. Prebuilt workspaces are initially owned by a built-in prebuilds system user. When a prebuilt workspace is claimed, a new session token is generated for the user that claimed the workspace, but the previous session token for the prebuilds user was not expired. Any Coder workspace templates that persist this automatically generated session token are potentially impacted. For example, the coder-login module allows template authors to automatically configure the coder CLI to be authenticated with the Coder deployment. This causes a script to be run on workspace startup that runs the command coder login using the automatically generated user session token c.f. https://github.com/coder/registry/blob/8677e7d52b374b025c4820d09049dc6b008beee8/registry/coder/modules/coder-login/main.tf#L23 This module was originally written before the inception of the prebuilds feature in Coder, which essentially creates a "pre-warmed" pool of workspaces owned by a particular prebuilds system user. When this module is invoked on a prebuilt workspace, it causes the Coder CLI inside the workspace to persist the session token for the prebuilds user to disk. Because the coder-login module checks if the CLI is authenticated, the script exits early before updating the session token, leaving the Coder CLI authenticated as the prebuildsuser upon claim: Impact Important: Deployments that have never utilized the prebuilds feature are not affected by this vulnerability. This vulnerability requires a previously authenticated user to claim a prebuilt workspace from a template configured to store the prebuilds user session token as described above. The prebuilds user has no specific roles, so its credential has the same level of access as a regular member user, meaning a user with the prebuilds user's credential can move laterally to any other prebuilt workspace, or create new workspaces as the prebuilds user. This means that a malicious authenticated actor can potentially execute code on other workspaces owned by the prebuilds user and potentially access information of other users once they claim a previously poisoned workspace. Remediation Fixed in https://github.com/coder/coder/pull/19667 Note that prebuilt workspaces claimed previous to the fix may have been affected by this vulnerability. It is recommended that users re-create their workspace if it was created from a prebuild. To identify potentially affected workspaces, run the following SQL query against the Coder database: Previous manually created tokens for the prebuilds user are left as-is. You may wish to review these via coder tokens list --all Premium license customers can also take advantage of the audit logs feature to query actions performed by the prebuilds user. Following filter can be used to verify if no API keys were created by the prebuilds user would indicate a potentially malicious action aimed at achieving persistence Following filter can be used to list all write operations performed by the prebuilds user (including failed attempts to update various settings) Patched versions 2.24.4 2.25.2 2.26.0
The application assigns, modifies, tracks, or checks privileges incorrectly, allowing a user to gain elevated access. Typical impact: privilege escalation beyond the intended level.
CVE-2025-58437 has a CVSS score of 8.1 (High). The vector is network-reachable, low privileges required, and no user interaction. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment.
A fixed version is available (2.24.4, 2.25.2). Upgrading removes the vulnerable code path.
go
github.com/coder/coder/v2 (>= 2.22.0, < 2.24.4)github.com/coder/coder/v2 (>= 2.25.0, < 2.25.2)github.com/coder/coder/v2 → 2.24.4 (go)github.com/coder/coder/v2 → 2.25.2 (go)Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter instead of chasing every advisory.
Kodem's runtime-powered SCA identifies whether CVE-2025-58437 is reachable in your applications. Explore open-source security for your team.
See if CVE-2025-58437 is reachable in your applications. Get a demo
Already deployed Kodem? See CVE-2025-58437 in your environment →Upgrade the following packages to resolve this vulnerability:
github.com/coder/coder/v2 to 2.24.4 or latergithub.com/coder/coder/v2 to 2.25.2 or laterKodem Kai can prioritize this vulnerability in your dependency tree and generate a fix recommendation.
CVE-2025-58437 is a high-severity improper privilege management vulnerability in github.com/coder/coder/v2 (go), affecting versions >= 2.22.0, < 2.24.4. It is fixed in 2.24.4, 2.25.2. The application assigns, modifies, tracks, or checks privileges incorrectly, allowing a user to gain elevated access.
CVE-2025-58437 has a CVSS score of 8.1 (High). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
github.com/coder/coder/v2 (go) versions >= 2.22.0, < 2.24.4 is affected.
Yes. CVE-2025-58437 is fixed in 2.24.4, 2.25.2. Upgrade to this version or later.
Whether CVE-2025-58437 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
github.com/coder/coder/v2 to 2.24.4 or latergithub.com/coder/coder/v2 to 2.25.2 or later