« Volver al listado

CVE-2026-48722

Estado: Pendiente de análisisMedia (5.5)—

Nextflow is a DSL for data-driven computational pipelines. From 25.09.2-edge until 25.10.6 and 26.04.3, nextflow auth login writes Seqera Platform OIDC bearer tokens to ${NXF_HOME:-~/.nextflow}/seqera-auth.config through AuthCommandImpl.writeConfig in plugins/nf-tower/src/main/io/seqera/tower/plugin/auth/AuthCommandImpl.groovy without setting restrictive file permissions, allowing the default umask 022 to create the file with mode 0644. On a multi-user POSIX host, a local user who can traverse the victim's home directory can read seqera-auth.config and impersonate the victim against Seqera Platform within the token's scope. Single-user systems and headless CI runners that do not use the interactive login flow are not affected. This issue is fixed in 25.10.6 and 26.04.3.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Nextflow — NextflowAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-48722",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-48722",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-09-17T14:28:06.186459Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.5,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "nextflow-io",
          "product": "nextflow",
          "versions": [
            {
              "status": "affected",
              "version": ">= 25.09.2-edge, < 25.10.6"
            },
            {
              "status": "affected",
              "version": ">= 25.11.0-edge, < 26.04.3"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-09-15T15:17:16.020",
  "references": [
    {
      "url": "https://github.com/nextflow-io/nextflow/commit/41a5f24afec8a6e9769a24cae5e08b5462fbfdc1",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/nextflow-io/nextflow/commit/a2813c610a3e7f13d7a0a0b1b543b7ad47586eaa",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/nextflow-io/nextflow/pull/7182",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/nextflow-io/nextflow/releases/tag/v25.10.6",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/nextflow-io/nextflow/releases/tag/v26.04.3",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/nextflow-io/nextflow/security/advisories/GHSA-92qf-fcph-v5wr",
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-276"
        },
        {
          "lang": "en",
          "value": "CWE-732"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Nextflow is a DSL for data-driven computational pipelines. From 25.09.2-edge until 25.10.6 and 26.04.3, nextflow auth login writes Seqera Platform OIDC bearer tokens to ${NXF_HOME:-~/.nextflow}/seqera-auth.config through AuthCommandImpl.writeConfig in plugins/nf-tower/src/main/io/seqera/tower/plugin/auth/AuthCommandImpl.groovy without setting restrictive file permissions, allowing the default umask 022 to create the file with mode 0644. On a multi-user POSIX host, a local user who can traverse the victim's home directory can read seqera-auth.config and impersonate the victim against Seqera Platform within the token's scope. Single-user systems and headless CI runners that do not use the interactive login flow are not affected. This issue is fixed in 25.10.6 and 26.04.3."
    }
  ],
  "lastModified": "2026-09-30T17:43:24.057",
  "sourceIdentifier": "security-advisories@github.com"
}