EUVD-2026-42916Severity by source
AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N
Local-only exploitation requiring a low-privilege account, an active carve window (timing dependency), and admin-initiated carve; confidentiality-only impact with no data modification or availability loss.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
osquery is a SQL powered operating system instrumentation, monitoring, and analytics framework. Prior to 5.23.1, an unprivileged attacker can read the contents of an osquery file carve until the carve completes and the temporary files are deleted because in-progress carve directories are not created with private permissions. If the carve targets a directory that the attacker controls, arbitrary file reads are possible, such as sensitive local files. This issue is fixed in version 5.23.1.
AnalysisAI
File carve operations in osquery prior to 5.23.1 expose sensitive data due to world-readable temporary directory permissions, allowing a local unprivileged attacker to read carve contents during the collection window. If the carve targets a directory the attacker controls, the impact extends to arbitrary local file reads. No public exploit identified at time of analysis; the vendor-confirmed fix ships in osquery 5.23.1.
Technical ContextAI
osquery is a SQL-powered OS instrumentation framework (CPE: cpe:2.3:a:osquery:osquery:*:*:*:*:*:*:*:*) that enables endpoint telemetry and forensic file carving via SQL queries. The file carve feature collects files from a host into temporary directories for forwarding to a central store. CWE-279 (Incorrect Execution-Assigned Permissions) identifies the root cause: those in-progress carve directories are created without restrictive filesystem permissions, leaving their contents readable by any local user until the carve completes and the temporary files are removed. This is a classic insecure temporary file pattern where a privileged process fails to apply least-permission ownership before writing sensitive data.
RemediationAI
Upgrade to osquery 5.23.1, which corrects the carve directory permissions at creation time. The upstream fix is implemented in commit 6dabe9ded33bf9c6fc0f3e37ec364a1cbbd25d68 via PR #8961 (https://github.com/osquery/osquery/pull/8961) and is available as a tagged release at https://github.com/osquery/osquery/releases/tag/5.23.1. If immediate upgrade is not possible, restrict file carve target directories to paths owned by and accessible only to the osquery service account, preventing unprivileged users from traversing or reading those paths. Additionally, avoid scheduling carves against directories writable or accessible by untrusted local users. These compensating controls reduce but do not eliminate the race window; patching remains the definitive fix.
osquery before version 4.4.0 enables a privilege escalation vulnerability. Rated high severity (CVSS 8.2), this vulnerab
An issue was discovered in osquery. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, lo
osquery is a SQL powered operating system instrumentation, monitoring, and analytics framework. Rated medium severity (C
Incorrect validation of the TLS SNI hostname in osquery versions after 2.9.0 and before 4.2.0 could allow an attacker to
In some configurations an attacker can inject a new executable path into the extensions.load file for osquery and hard l
Local privilege escalation in osquery on Windows prior to 5.23.1 lets a standard (unprivileged) user escalate to SYSTEM
Local privilege escalation in osquery on Windows prior to 5.23.1 lets a standard user escalate to SYSTEM by planting a m
Same weakness CWE-279 – Incorrect Execution-Assigned Permissions
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today