CVE-2026-48722 in Nextflow
Summary
by MITRE • 09/15/2026
Nextflow is a DSL for data-driven computational pipelines. From 25.09.2-edge until 25.10.6 and 26.04.3, nextflow auth login writes Seqera Platform OIDC bearer tokens to ${NXF_HOME:-~/.nextflow}/seqera-auth.config through AuthCommandImpl.writeConfig in plugins/nf-tower/src/main/io/seqera/tower/plugin/auth/AuthCommandImpl.groovy without setting restrictive file permissions, allowing the default umask 022 to create the file with mode 0644. On a multi-user POSIX host, a local user who can traverse the victim's home directory can read seqera-auth.config and impersonate the victim against Seqera Platform within the token's scope. Single-user systems and headless CI runners that do not use the interactive login flow are not affected. This issue is fixed in 25.10.6 and 26.04.3.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/15/2026
The vulnerability identified involves a critical information disclosure flaw within Nextflow, specifically affecting versions from 25.09.2-edge through 25.10.6 and version 26.04.3 of the software. This issue arises during the authentication process when users execute the nextflow auth login command to connect with the Seqera Platform. The core technical flaw resides in the AuthCommandImpl.writeConfig method located within the plugins/nf-tower/src/main/io/seqera/tower/plugin/auth/AuthCommandImpl.groovy file. When this function writes the OpenID Connect OIDC bearer tokens to a configuration file named seqera-auth.config, it fails to enforce restrictive file permissions on the newly created or overwritten file. Consequently, the operating system applies its default umask setting of 022, which results in the file being created with mode 0644. This permission set grants read access to all users on a POSIX-compliant system who have traversability rights over the victim's home directory, thereby exposing sensitive authentication credentials to unauthorized parties.
The operational impact of this vulnerability is significant for multi-user environments where multiple individuals share access to the same host machine or compute cluster. A local attacker with basic file traversal capabilities can locate and read the seqera-auth.config file within a targeted user's home directory at ${NXF_HOME:-~/.nextflow}/seqera-auth.config. By extracting the OIDC bearer token stored in this plaintext configuration, an adversary can impersonate the victim against the Seqera Platform API. This unauthorized access allows the attacker to execute pipeline runs, view sensitive project data, and potentially manipulate computational resources within the scope permitted by the stolen token's permissions. The severity of this impact is heightened because bearer tokens often provide broad administrative or execution privileges, effectively granting full control over the victim's workflow infrastructure without requiring further authentication steps such as passwords or multi-factor verification.
This vulnerability maps directly to CWE-732: Incorrect Permission Assignment for Critical Resource, as it involves a failure to set appropriate access controls on a file containing sensitive security credentials. Furthermore, from an offensive perspective, this flaw facilitates Credential Access via Local File Inclusion techniques described in the MITRE ATT&CK framework under T1552.004 (Unsecured Credentials: Private Keys) or more broadly T1556 (Modifying Authentication Process), as it allows for credential theft that compromises the authentication mechanism itself. The attack vector is local, requiring physical or shell access to the host system, which classifies this primarily as a privilege escalation or lateral movement enabler in shared computing environments rather than a remote code execution risk.
The vulnerability does not affect single-user systems where only one individual has access to the home directory, nor does it impact headless CI runners that do not utilize interactive login flows requiring persistent token storage on disk. For affected multi-user deployments, mitigation requires immediate upgrading to version 25.10.6 or later, which includes a patch ensuring that file permissions are correctly restricted during the write operation of authentication configurations. In environments where an upgrade is not immediately feasible, administrators should manually secure any existing seqera-auth.config files by setting their permissions to mode 0600 using chmod commands, restricting read and write access solely to the owning user. Additionally, implementing strict umask settings for Nextflow execution contexts or utilizing encrypted storage solutions for sensitive configuration data can provide additional layers of defense against local credential theft attacks.