What is the CVSS score of EUVD-2026-78578?

EUVD-2026-78578 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Is there a patch available for EUVD-2026-78578?

Yes, a patch is available for EUVD-2026-78578. Update the affected software to the latest version immediately.

Nextflow EUVD-2026-78578

Q: Which versions of Nextflow are affected by EUVD-2026-78578?

Insecure default file permissions in Nextflow's `auth login` command expose Seqera Platform OIDC bearer tokens to any local user on shared POSIX systems running affected versions 25.09.2-edge through…. A patch is available.

| CVE-2026-48722 MEDIUM

Incorrect Default Permissions (CWE-276)

2026-06-25 https://github.com/nextflow-io/nextflow

GHSA-92qf-fcph-v5wr

Privilege Escalation Java

5.5

CVSS 3.1 · Vendor: https://github.com/nextflow-io/nextflow

Severity by source

Vendor (https://github.com/nextflow-io/nextflow) PRIMARY

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

5.5 MEDIUM

Local low-privileged shell access required to read the credential file; sole measurable impact is confidentiality of the stored bearer token with no integrity or availability effect.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (https://github.com/nextflow-io/nextflow).

CVSS VectorVendor: https://github.com/nextflow-io/nextflow

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

Jun 25, 2026 - 22:38 vuln.today

Analysis Generated

Jun 25, 2026 - 22:38 vuln.today

DescriptionCVE.org

Impact

nextflow auth login persists Seqera Platform OIDC tokens to ${NXF_HOME:-~/.nextflow}/seqera-auth.config. The file is created via Java NIO without specifying file permissions, so under the default umask 022 it lands at mode 0644 (world-readable).

On a multi-user POSIX host - typically an HPC login node, shared workstation, or jump host - any local user able to traverse the victim's home directory can read the file and obtain a valid Platform bearer token, enabling impersonation against Seqera Platform within the token's scope.

Single-user systems and headless CI runners, which do not invoke the interactive login flow, are not affected.

Affected versions: 25.09.2-edge through 26.04.1.

Patches

Fixed in <PATCHED_VERSION>. The patched code applies mode 0600 to seqera-auth.config immediately after writing it, and re-applies on every subsequent login so any pre-existing world-readable copy left by an earlier version is tightened.

Tokens previously stored in the file must be treated as disclosed. After upgrading, run nextflow auth logout, revoke the token in the Seqera Platform UI, and run nextflow auth login again.

Workarounds

Restrict the file and its parent directory:

chmod 600 "${NXF_HOME:-$HOME/.nextflow}/seqera-auth.config" chmod 700 "${NXF_HOME:-$HOME/.nextflow}"

Alternatively, supply the Platform token via the TOWER_ACCESS_TOKEN environment variable instead of running nextflow auth login.

References

https://cwe.mitre.org/data/definitions/276.html

AnalysisAI

Insecure default file permissions in Nextflow's auth login command expose Seqera Platform OIDC bearer tokens to any local user on shared POSIX systems running affected versions 25.09.2-edge through 26.04.1. The credential file seqera-auth.config is written via Java NIO without explicit permission bits, landing at mode 0644 under the typical umask 022, making it world-readable on HPC login nodes, shared workstations, and jump hosts - exactly the infrastructure where Nextflow is most commonly deployed. No public exploit has been identified at time of analysis and this vulnerability is not currently in the CISA KEV catalog, but the attack requires only a standard local account and trivial filesystem read, making it a practical lateral-movement primitive in multi-tenant research computing environments.

Technical ContextAI

Nextflow is a bioinformatics workflow orchestration engine distributed as the Maven artifact io.nextflow:nextflow. Its Seqera Platform integration authenticates via OIDC and, when nextflow auth login is run interactively, persists the resulting bearer token to ${NXF_HOME:-~/.nextflow}/seqera-auth.config. The file is created through Java NIO's default file-creation path, which does not specify POSIX permission attributes - the resulting permissions are therefore determined entirely by the process umask. Under the near-universal default of umask 022, this produces mode 0644 (owner rw, group r, world r). CWE-276 (Incorrect Default Permissions) is the precise root cause: the application fails to enforce least-privilege file permissions when persisting sensitive credentials, violating the principle that credential stores must be owner-readable only (mode 0600). The CPE data confirms the affected artifact is pkg:maven/io.nextflow:nextflow across two release trains.

RemediationAI

Upgrade to Nextflow 25.10.6 (25.x branch) or 26.04.3 (26.x branch); these releases apply mode 0600 to seqera-auth.config immediately after writing and re-apply the restriction on every subsequent login, also correcting any pre-existing world-readable copy created by a vulnerable version. After upgrading, previously stored tokens must be treated as disclosed: run nextflow auth logout, revoke the token in the Seqera Platform UI, then re-authenticate with nextflow auth login to generate a fresh credential written with correct permissions. For immediate pre-patch mitigation on vulnerable systems, run chmod 600 "${NXF_HOME:-$HOME/.nextflow}/seqera-auth.config" and chmod 700 "${NXF_HOME:-$HOME/.nextflow}" - this tightens existing exposure but does not prevent recurrence if nextflow auth login is re-run on a vulnerable version, as the file will be recreated world-readable. A persistent workaround that avoids disk-based credential storage entirely is to supply the token via the TOWER_ACCESS_TOKEN environment variable rather than using nextflow auth login; this eliminates the file-based exposure but requires secure injection of the variable (e.g., via a CI secrets manager or PAM environment configuration), which may be operationally complex in HPC settings. See the advisory at https://github.com/nextflow-io/nextflow/security/advisories/GHSA-92qf-fcph-v5wr.