Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Unauthenticated agent debug manifest endpoint exposes environment variable values across workspace users

Low
jdomeracki-coder published GHSA-73wg-wxvv-9r4j Aug 10, 2026

Package

Codestin Search App github.com/coder/coder/v2 (Go)

Affected versions

>= 2.10.0, < 2.34.8

Patched versions

2.34.8

Description

Summary

The Coder agent runs an unauthenticated debug HTTP server on 127.0.0.1:2113 by default. Its /debug/manifest handler JSON-encoded the full agent manifest, including the values of EnvironmentVariables. Because the endpoint is reachable by any process in the workspace regardless of Unix user, template-provided environment values that may carry credentials (for example cloud keys or registry tokens) were readable by other, lower-privileged users in the same workspace.

Note: The dedicated workspace Secrets system is not exposed by this endpoint, and the same environment variables are already inherited by processes the owner runs. Practical impact is limited to disclosing template-set environment values to co-tenant Unix users who could not otherwise read the owner's environment, so this is rated low severity.

Impact

A low-privileged process or user inside a workspace (for example untrusted in-workspace code running as a separate Unix user) could fetch http://127.0.0.1:2113/debug/manifest and read the values of environment variables injected by the workspace template. When a template places secret material in environment variables, those secrets were disclosed across the Unix-user boundary within the workspace. No authentication bypass, cross-workspace access, or exposure of the separate Secrets store resulted.

Patches

The debug manifest response now redacts environment variable values, replacing them with ***REDACTED*** while preserving the keys so operators can still confirm which variables are configured. This matches the existing support-bundle sanitizeEnv behavior. Empty values, which carry no secret, are preserved.

Release line Patched version
2.36 (main) v2.36.0
2.35 v2.35.0
2.34 v2.34.8

Workarounds

Avoid injecting secret material through template environment variables; use the workspace Secrets mechanism instead. Restrict workspace access to trusted users, since any co-tenant process could otherwise read the manifest.

References

Credits

We'd like to thank Anthropic's Security Team (ANT-2026-22461) for independently disclosing this issue!

Severity

Low

CVSS overall score

This score calculates overall vulnerability severity from 0 to 10 and is based on the Common Vulnerability Scoring System (CVSS).
/ 10

CVSS v3 base metrics

Attack vector
Local
Attack complexity
Low
Privileges required
Low
User interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None

CVSS v3 base metrics

Attack vector: More severe the more the remote (logically and physically) an attacker can be in order to exploit the vulnerability.
Attack complexity: More severe for the least complex attacks.
Privileges required: More severe if no privileges are required.
User interaction: More severe when no user interaction is required.
Scope: More severe when a scope change occurs, e.g. one vulnerable component impacts resources in components beyond its security scope.
Confidentiality: More severe when loss of data confidentiality is highest, measuring the level of data access available to an unauthorized user.
Integrity: More severe when loss of data integrity is the highest, measuring the consequence of data modification possible by an unauthorized user.
Availability: More severe when the loss of impacted component availability is highest.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

CVE ID

No known CVE

Weaknesses

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. Learn more on MITRE.

Insufficiently Protected Credentials

The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval. Learn more on MITRE.