Executive Summary

This vulnerability involves Coder's Workspace Agent logging manifests that contain sensitive values in plaintext without sanitization. This means that sensitive information could be exposed in logs. An attacker with limited local access to the Coder Workspace environment or access to third-party systems that collect these logs could retrieve sensitive data from these logs.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can lead to unauthorized disclosure of sensitive information through logs. An attacker with limited local access or access to logging systems could obtain sensitive data, potentially leading to data breaches, loss of confidentiality, and further exploitation of the environment.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Coder Workspace Agent to version 2.26.5, 2.27.7, or 2.28.4 or later, as these versions contain the fix for the vulnerability where sensitive values in Workspace Agent manifests were logged in plaintext.

Useful 0 Not Useful 0