{"id":"CVE-2026-48722","aliases":["EUVD-2026-78578","GHSA-92qf-fcph-v5wr"],"status":"published","title":"Nextflow: Incorrect default permissions in the nextflow auth login command","description":"Nextflow is a DSL for data-driven computational pipelines. From 25.09.2-edge until 25.10.6 and 26.04.3, nextflow auth login writes Seqera Platform OIDC bearer tokens to ${NXF_HOME:-~/.nextflow}/seqera-auth.config through AuthCommandImpl.writeConfig in plugins/nf-tower/src/main/io/seqera/tower/plugin/auth/AuthCommandImpl.groovy without setting restrictive file permissions, allowing the default umask 022 to create the file with mode 0644. On a multi-user POSIX host, a local user who can traverse the victim's home directory can read seqera-auth.config and impersonate the victim against Seqera Platform within the token's scope. Single-user systems and headless CI runners that do not use the interactive login flow are not affected. This issue is fixed in 25.10.6 and 26.04.3.","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00142,"percentile":0.03579,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-276","CWE-732"],"published":"2026-06-25T21:45:55Z","modified":"2026-10-28T02:31:04Z","fixes":[{"ecosystem":"Maven","package":"io.nextflow:nextflow","fixed_in":["25.10.6","26.04.3"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"io.nextflow:nextflow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"25.09.2-edge"},{"fixed":"25.10.6"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"io.nextflow:nextflow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"26.00.0-edge"},{"fixed":"26.04.3"}]}]},{"source":"osv","ecosystem":"Maven","package":"io.nextflow:nextflow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"25.09.2-edge"},{"fixed":"25.10.6"}]}]},{"source":"osv","ecosystem":"Maven","package":"io.nextflow:nextflow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"26.00.0-edge"},{"fixed":"26.04.3"}]}]}],"products":[{"vendor":"nextflow-io","product":"nextflow"}],"references":[{"url":"https://github.com/nextflow-io/nextflow/security/advisories/GHSA-92qf-fcph-v5wr","tags":["x_refsource_CONFIRM","advisory","web"]},{"url":"https://github.com/nextflow-io/nextflow/pull/7182","tags":["x_refsource_MISC","fix"]},{"url":"https://github.com/nextflow-io/nextflow/commit/41a5f24afec8a6e9769a24cae5e08b5462fbfdc1","tags":["x_refsource_MISC","fix"]},{"url":"https://github.com/nextflow-io/nextflow/commit/a2813c610a3e7f13d7a0a0b1b543b7ad47586eaa","tags":["x_refsource_MISC","fix"]},{"url":"https://github.com/nextflow-io/nextflow/releases/tag/v25.10.6","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/nextflow-io/nextflow/releases/tag/v26.04.3","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/advisories/GHSA-92qf-fcph-v5wr"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48722.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48722","tags":["advisory"]},{"url":"https://github.com/nextflow-io/nextflow","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-48722","title":"Nextflow: Incorrect default permissions in the nextflow auth login command","description":"Nextflow is a DSL for data-driven computational pipelines. From 25.09.2-edge until 25.10.6 and 26.04.3, nextflow auth login writes Seqera Platform OIDC bearer tokens to ${NXF_HOME:-~/.nextflow}/seqera-auth.config through AuthCommandImpl.writeConfig in plugins/nf-tower/src/main/io/seqera/tower/plugin/auth/AuthCommandImpl.groovy without setting restrictive file permissions, allowing the default umask 022 to create the file with mode 0644. On a multi-user POSIX host, a local user who can traverse the victim's home directory can read seqera-auth.config and impersonate the victim against Seqera Platform within the token's scope. Single-user systems and headless CI runners that do not use the interactive login flow are not affected. This issue is fixed in 25.10.6 and 26.04.3.","status":"published","published":"2026-09-15T14:07:45.568Z","modified":"2026-09-17T14:28:18.251Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-276","CWE-732"],"updated_at":"2026-11-02T13:50:49.872037Z"}],"euvd":[{"id":"EUVD-2026-78578","description":"Nextflow is a DSL for data-driven computational pipelines. From 25.09.2-edge until 25.10.6 and 26.04.3, nextflow auth login writes Seqera Platform OIDC bearer tokens to ${NXF_HOME:-~/.nextflow}/seqera-auth.config through AuthCommandImpl.writeConfig in plugins/nf-tower/src/main/io/seqera/tower/plugin/auth/AuthCommandImpl.groovy without setting restrictive file permissions, allowing the default umask 022 to create the file with mode 0644. On a multi-user POSIX host, a local user who can traverse the victim's home directory can read seqera-auth.config and impersonate the victim against Seqera Platform within the token's scope. Single-user systems and headless CI runners that do not use the interactive login flow are not affected. This issue is fixed in 25.10.6 and 26.04.3.","status":"published","published":"2026-09-15T14:07:45Z","modified":"2026-09-17T14:28:18Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T17:28:12.076337Z"}],"ghsa":[{"id":"GHSA-92qf-fcph-v5wr","title":"nextflow auth login command has incorrect default permissions","description":"### Impact\n\n`nextflow auth login` persists Seqera Platform OIDC tokens to `${NXF_HOME:-~/.nextflow}/seqera-auth.config`. The file is created via Java NIO without specifying file permissions, so under the default `umask 022` it lands at mode `0644` (world-readable).\n\nOn a multi-user POSIX host — typically an HPC login node, shared workstation, or jump host — any local user able to traverse the victim's home directory can read the file and obtain a valid Platform bearer token, enabling impersonation against Seqera Platform within the token's scope.\n\nSingle-user systems and headless CI runners, which do not invoke the interactive login flow, are not affected.\n\nAffected versions:  `25.09.2-edge` through `26.04.1`.\n  \n### Patches\n\nFixed in `\u003cPATCHED_VERSION\u003e`. The patched code applies mode `0600` to `seqera-auth.config` immediately after writing it, and re-applies on every subsequent login so any pre-existing world-readable copy left by an earlier version is tightened.\n\nTokens previously stored in the file must be treated as disclosed. After upgrading, run `nextflow auth logout`, revoke the token in the Seqera Platform UI, and run `nextflow auth login` again.\n\n### Workarounds\n  \nRestrict the file and its parent directory:\n\n`chmod 600 \"${NXF_HOME:-$HOME/.nextflow}/seqera-auth.config\"`\n`chmod 700 \"${NXF_HOME:-$HOME/.nextflow}\"`\n\nAlternatively, supply the Platform token via the `TOWER_ACCESS_TOKEN` environment variable instead of running `nextflow auth login`.\n\n### References\n  \n  - https://cwe.mitre.org/data/definitions/276.html","status":"published","published":"2026-06-25T21:45:55Z","modified":"2026-06-25T21:45:56Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-276","CWE-732"],"updated_at":"2026-11-02T14:40:33.778544Z"}],"nvd":[{"id":"CVE-2026-48722","description":"Nextflow is a DSL for data-driven computational pipelines. From 25.09.2-edge until 25.10.6 and 26.04.3, nextflow auth login writes Seqera Platform OIDC bearer tokens to ${NXF_HOME:-~/.nextflow}/seqera-auth.config through AuthCommandImpl.writeConfig in plugins/nf-tower/src/main/io/seqera/tower/plugin/auth/AuthCommandImpl.groovy without setting restrictive file permissions, allowing the default umask 022 to create the file with mode 0644. On a multi-user POSIX host, a local user who can traverse the victim's home directory can read seqera-auth.config and impersonate the victim against Seqera Platform within the token's scope. Single-user systems and headless CI runners that do not use the interactive login flow are not affected. This issue is fixed in 25.10.6 and 26.04.3.","status":"published","published":"2026-09-15T15:17:16.02Z","modified":"2026-09-30T17:43:24.057Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-276","CWE-732"],"updated_at":"2026-11-02T14:12:47.668237Z"}],"osv":[{"id":"CVE-2026-48722","title":"Nextflow: Incorrect default permissions in the nextflow auth login command","description":"Nextflow is a DSL for data-driven computational pipelines. From 25.09.2-edge until 25.10.6 and 26.04.3, nextflow auth login writes Seqera Platform OIDC bearer tokens to ${NXF_HOME:-~/.nextflow}/seqera-auth.config through AuthCommandImpl.writeConfig in plugins/nf-tower/src/main/io/seqera/tower/plugin/auth/AuthCommandImpl.groovy without setting restrictive file permissions, allowing the default umask 022 to create the file with mode 0644. On a multi-user POSIX host, a local user who can traverse the victim's home directory can read seqera-auth.config and impersonate the victim against Seqera Platform within the token's scope. Single-user systems and headless CI runners that do not use the interactive login flow are not affected. This issue is fixed in 25.10.6 and 26.04.3.","status":"published","published":"2026-09-15T14:07:45.568Z","modified":"2026-10-28T02:31:04.439663604Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-276","CWE-732"],"updated_at":"2026-11-02T15:45:06.701612Z"},{"id":"GHSA-92qf-fcph-v5wr","title":"nextflow auth login command has incorrect default permissions","description":"### Impact\n\n`nextflow auth login` persists Seqera Platform OIDC tokens to `${NXF_HOME:-~/.nextflow}/seqera-auth.config`. The file is created via Java NIO without specifying file permissions, so under the default `umask 022` it lands at mode `0644` (world-readable).\n\nOn a multi-user POSIX host — typically an HPC login node, shared workstation, or jump host — any local user able to traverse the victim's home directory can read the file and obtain a valid Platform bearer token, enabling impersonation against Seqera Platform within the token's scope.\n\nSingle-user systems and headless CI runners, which do not invoke the interactive login flow, are not affected.\n\nAffected versions:  `25.09.2-edge` through `26.04.1`.\n  \n### Patches\n\nFixed in `\u003cPATCHED_VERSION\u003e`. The patched code applies mode `0600` to `seqera-auth.config` immediately after writing it, and re-applies on every subsequent login so any pre-existing world-readable copy left by an earlier version is tightened.\n\nTokens previously stored in the file must be treated as disclosed. After upgrading, run `nextflow auth logout`, revoke the token in the Seqera Platform UI, and run `nextflow auth login` again.\n\n### Workarounds\n  \nRestrict the file and its parent directory:\n\n`chmod 600 \"${NXF_HOME:-$HOME/.nextflow}/seqera-auth.config\"`\n`chmod 700 \"${NXF_HOME:-$HOME/.nextflow}\"`\n\nAlternatively, supply the Platform token via the `TOWER_ACCESS_TOKEN` environment variable instead of running `nextflow auth login`.\n\n### References\n  \n  - https://cwe.mitre.org/data/definitions/276.html","status":"published","published":"2026-06-25T21:45:55Z","modified":"2026-06-25T22:11:29.527989Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-276","CWE-732"],"updated_at":"2026-11-02T15:46:43.123867Z"}]}}