Medium, CVSS 5.5MavenPublished
nextflow auth login command has incorrect default permissions
CVE-2026-48722 · GHSA-92qf-fcph-v5wr
- Affected
- Maven io.nextflow:nextflow >= 25.09.2-edge, < 25.10.6; >= 26.00.0-edge, < 26.04.3
- Fixed in
- 26.04.325.10.6· Vendor fix available
- Issue
- Impact nextflow auth login persists Seqera Platform OIDC tokens to ${NXFHOME:-~/.nextflow}/seqera-auth.config. The file is created via Java NIO without specifying file permissions, so under the default umask 022 it lands at mode 0644 (world-readable). On a multi-user POSIX host — typically an HPC login node, shared workstation, or jump host — any local user able to traverse the victim's home directory can read the file and obtain a valid Platform bearer token, enabling impersonation against Seqera Platform within the token's scope. Single-user systems and headless CI runners, which do not invoke the interactive login flow, are not affected. Affected versions: 25.09.2-edge through 26.04.1. Patches Fixed in <PATCHEDVERSION. The patched code applies mode 0600 to seqera-auth.config immediately after writing it, and re-applies on every subsequent login so any pre-existing world-readable copy left by an earlier version is tightened. Tokens previously stored in the file must be treated as…
Recommended action: Upgrade to 26.04.3 or 25.10.6 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.