CVE-2026-48722
Received Received - Intake

Information Disclosure in Nextflow Seqera Platform Auth

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: GitHub, Inc.

Description
Nextflow is a DSL for data-driven computational pipelines. From 25.09.2-edge until 25.10.6 and 26.04.3, nextflow auth login writes Seqera Platform OIDC bearer tokens to ${NXF_HOME:-~/.nextflow}/seqera-auth.config through AuthCommandImpl.writeConfig in plugins/nf-tower/src/main/io/seqera/tower/plugin/auth/AuthCommandImpl.groovy without setting restrictive file permissions, allowing the default umask 022 to create the file with mode 0644. On a multi-user POSIX host, a local user who can traverse the victim's home directory can read seqera-auth.config and impersonate the victim against Seqera Platform within the token's scope. Single-user systems and headless CI runners that do not use the interactive login flow are not affected. This issue is fixed in 25.10.6 and 26.04.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-48722
EUVD
EUVD-2026-78578

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
seqera nextflow From 25.09.2-edge (inc) to 25.10.6 (inc)
seqera nextflow 25.10.6
seqera nextflow 26.04.3
seqera nextflow From 25.09.2-edge (inc) to 26.04.3 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-732 The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
CWE-276 During installation, installed file permissions are set to allow anyone to modify those files.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Nextflow versions between 25.09.2-edge and 26.04.2. When users run 'nextflow auth login', the tool writes Seqera Platform OIDC bearer tokens to a file called seqera-auth.config in the user's home directory. The file is created with default permissions 0644, making it readable by all users on a multi-user POSIX system. This allows any local user to read the token and impersonate the victim on the Seqera Platform.

Detection Guidance

Check for the existence of the seqera-auth.config file in ${NXF_HOME:-~/.nextflow}/ and verify its permissions using: ls -l ~/.nextflow/seqera-auth.config. If the file exists and shows permissions like -rw-r--r-- (0644), it is vulnerable.

Impact Analysis

On a multi-user POSIX host, any local user who can access the victim's home directory can read the token file and use it to impersonate the victim against Seqera Platform within the token's scope. This could lead to unauthorized access to data or actions on the platform. Single-user systems and headless CI runners are not affected.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by exposing authentication tokens through improper file permissions. Unauthorized access to tokens may lead to unauthorized data access or processing, violating confidentiality requirements under these regulations.

Mitigation Strategies

Upgrade Nextflow to version 25.10.6 or 26.04.3 or later. Revoke the exposed token via the Seqera Platform UI and re-authenticate. Alternatively, manually set file permissions to 0600 using chmod 600 ~/.nextflow/seqera-auth.config.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-48722. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart