Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-48722

Nextflow: Incorrect default permissions in the nextflow auth login command

CVSS 3.1 5.5 MEDIUMCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-48722

Published

Nextflow is a DSL for data-driven computational pipelines. From 25.09.2-edge until 25.10.6 and 26.04.3, nextflow auth login writes Seqera Platform OIDC bearer tokens to ${NXF_HOME:-~/.nextflow}/seqera-auth.config through AuthCommandImpl.writeConfig in plugins/nf-tower/src/main/io/seqera/tower/plugin/auth/AuthCommandImpl.groovy without setting restrictive file permissions, allowing the default umask 022 to create the file with mode 0644. On a multi-user POSIX host, a local user who can traverse the victim's home directory can read seqera-auth.config and impersonate the victim against Seqera Platform within the token's scope. Single-user systems and headless CI runners that do not use the interactive login flow are not affected. This issue is fixed in 25.10.6 and 26.04.3.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-48722

Published

nextflow

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "nextflow-io",
                    "product": "nextflow",
                    "versions": [
                        {
                            "version": ">= 25.09.2-edge, < 25.10.6",
                            "status": "affected"
                        },
                        {
                            "version": ">= 25.11.0-edge, < 26.04.3",
                            "status": "affected"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON