osquery CVE-2026-46388

Exploitation requires four concurrent conditions: (1) the attacker holds a local unprivileged account (PR:L) on the host running osquery; (2) a file carve must be actively in progress - triggered by an administrator or automated query schedule (UI:R); (3) the attacker must have read access to the osquery temporary carve directory (the core permission gap) or control over the carve target directory (AC:H); and (4) the attacker must act within the carve's active window before temporary files are deleted. Exploitation is bounded by carve duration and local access - remote unauthenticated exploitation is not possible. The attack does not apply to osquery deployments that never use the file carve feature.

CVSS 4.4 Medium (AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N) correctly characterises this as a local, high-complexity, confidentiality-only issue. The local attack vector (AV:L) means network-based exploitation is not possible; an attacker must already hold a local shell. High complexity (AC:H) reflects the narrow exploitation window - the attacker must either time access to an ongoing carve or control the carve target directory. User interaction (UI:R) indicates a privileged operator must initiate the carve, limiting opportunistic exploitation. Despite the High confidentiality impact (C:H), which reflects that sensitive files can be fully exposed, these combined constraints suppress the real-world severity well below a critical threshold. No EPSS data was provided and the CVE is not listed in the CISA KEV catalogue, consistent with a localised information-disclosure pattern. This is a meaningful risk in environments with untrusted local users co-existing with security tooling (e.g., shared servers, SOC analyst workstations), but not a mass-exploitation priority.

A local low-privileged attacker on a monitored host waits for an osquery administrator to schedule or trigger a file carve. During the carve operation, the attacker polls or watches the osquery temporary working directory and reads the carve contents - which may include configuration files, credentials, or other sensitive data - before cleanup occurs. If the attacker can place a symlink or otherwise influence the carve target path, they can extend this to read files outside the intended carve scope.