Nextflow: Incorrect default permissions in the nextflow auth login command
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.
Summary
Nextflow is a DSL for data-driven computational pipelines. From 25.09.2-edge until 25.10.6 and 26.04.3, nextflow auth login writes Seqera Platform OIDC bearer tokens to ${NXF_HOME:-~/.nextflow}/seqera-auth.config through AuthCommandImpl.writeConfig in plugins/nf-tower/src/main/io/seqera/tower/plugin/auth/AuthCommandImpl.groovy without setting restrictive file permissions, allowing the default umask 022 to create the file with mode 0644. On a multi-user POSIX host, a local user who can traverse the victim's home directory can read seqera-auth.config and impersonate the victim against Seqera Platform within the token's scope. Single-user systems and headless CI runners that do not use the interactive login flow are not affected. This issue is fixed in 25.10.6 and 26.04.3.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| nextflow-io | nextflow | 25.09.2-edge to before 25.10.6; 25.11.0-edge to before 26.04.3 | 25.10.6, 26.04.3 | Patch available | CNA |
| — | io.nextflow:nextflow (Maven) | 25.09.2-edge to before 25.10.6 | 25.10.6 | Patch available | GHSA-92qf-fcph-v5wr |
| — | io.nextflow:nextflow (Maven) | 26.00.0-edge to before 26.04.3 | 26.04.3 | Patch available | GHSA-92qf-fcph-v5wr |
- nextflow Vendornextflow-io Affected 25.09.2-edge to before 25.10.6; 25.11.0-edge to before 26.04.3 Fixed in 25.10.6, 26.04.3 Patch available CNA
- io.nextflow:nextflow (Maven) Vendor— Affected 25.09.2-edge to before 25.10.6 Fixed in 25.10.6 Patch available GHSA-92qf-fcph-v5wr
- io.nextflow:nextflow (Maven) Vendor— Affected 26.00.0-edge to before 26.04.3 Fixed in 26.04.3 Patch available GHSA-92qf-fcph-v5wr
Remediation
- Fix · CNA nextflow (nextflow-io) Fixed in 25.10.6, 26.04.3
- Fix · GHSA-92qf-fcph-v5wr io.nextflow:nextflow (Maven) Fixed in 25.10.6 Advisory →
- Fix · GHSA-92qf-fcph-v5wr io.nextflow:nextflow (Maven) Fixed in 26.04.3 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-48722
- 2026-10-03 Alias added: GHSA-92qf-fcph-v5wr
References
Other 7
- https://github.com/nextflow-io/nextflow/security/advisories/GHSA-92qf-fcph-v5wr
- https://github.com/nextflow-io/nextflow/pull/7182
- https://github.com/nextflow-io/nextflow/commit/41a5f24afec8a6e9769a24cae5e08b5462fbfdc1
- https://github.com/nextflow-io/nextflow/commit/a2813c610a3e7f13d7a0a0b1b543b7ad47586eaa
- https://github.com/nextflow-io/nextflow/releases/tag/v25.10.6
- https://github.com/nextflow-io/nextflow/releases/tag/v26.04.3
- https://github.com/nextflow-io/nextflow
Sources
- CVE-2026-48722 · CVE Program
- CVE-2026-48722 · NVD
- FIRST EPSS
- GHSA-92qf-fcph-v5wr · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences