CVE-2026-48722

Katalog CVE

CVSS 5.5 · Medium EPSS 0,14%

Kerentanan Incorrect Default Permissions. Skor CVSS 3.1 5.5 (Medium) menurut github.com.

Deskripsi (NVD)

Nextflow is a DSL for data-driven computational pipelines. From 25.09.2-edge until 25.10.6 and 26.04.3, nextflow auth login writes Seqera Platform OIDC bearer tokens to ${NXF_HOME:-~/.nextflow}/seqera-auth.config through AuthCommandImpl.writeConfig in plugins/nf-tower/src/main/io/seqera/tower/plugin/auth/AuthCommandImpl.groovy without setting restrictive file permissions, allowing the default umask 022 to create the file with mode 0644. On a multi-user POSIX host, a local user who can traverse the victim's home directory can read seqera-auth.config and impersonate the victim against Seqera Platform within the token's scope. Single-user systems and headless CI runners that do not use the interactive login flow are not affected. This issue is fixed in 25.10.6 and 26.04.3.

Rincian

Terbit di NVD

15 September 2026

Terakhir diubah

30 September 2026

Status NVD

Awaiting Analysis

CVSS 3.1

5.5 (Medium), sumber github.com
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-276: Incorrect Default Permissions
CWE-732: Incorrect Permission Assignment for Critical Resource

EPSS (30 hari)

0,14% peluang dieksploitasi; lebih tinggi dari 3,1% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/nextflow-io/nextflow/commit/41a5f24afec8a6e9769a24cae5e08b5462fbfdc1
• https://github.com/nextflow-io/nextflow/commit/a2813c610a3e7f13d7a0a0b1b543b7ad47586eaa
• https://github.com/nextflow-io/nextflow/pull/7182
• https://github.com/nextflow-io/nextflow/releases/tag/v25.10.6
• https://github.com/nextflow-io/nextflow/releases/tag/v26.04.3
• https://github.com/nextflow-io/nextflow/security/advisories/GHSA-92qf-fcph-v5wr