{"id":"CVE-2026-48722","title":"Nextflow is a DSL for data-driven computational pipelines","summary":"Nextflow is a DSL for data-driven computational pipelines. From 25.09.2-edge until 25.10.6 and 26.04.3, nextflow auth login writes Seqera Platform OIDC bearer tokens to ${NXF_HOME:-~/.nextflow}/seqera-auth.config through AuthCommandImpl.…","severity":"medium","cvss":5.5,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cwe":["CWE-276","CWE-732"],"vendor":"nextflow-io","product":"nextflow","affected":["nextflow >= 25.09.2-edge, < 25.10.6","nextflow >= 25.11.0-edge, < 26.04.3"],"patched":["io.nextflow:nextflow 25.10.6","io.nextflow:nextflow 26.04.3"],"published":"2026-09-15","updated":"2026-09-17","sourceUpdated":"2026-09-17T15:16:47.190","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-48722","references":[{"url":"https://github.com/nextflow-io/nextflow/commit/41a5f24afec8a6e9769a24cae5e08b5462fbfdc1","label":"security-advisories@github.com"},{"url":"https://github.com/nextflow-io/nextflow/commit/a2813c610a3e7f13d7a0a0b1b543b7ad47586eaa","label":"security-advisories@github.com"},{"url":"https://github.com/nextflow-io/nextflow/pull/7182","label":"security-advisories@github.com"},{"url":"https://github.com/nextflow-io/nextflow/releases/tag/v25.10.6","label":"security-advisories@github.com"},{"url":"https://github.com/nextflow-io/nextflow/releases/tag/v26.04.3","label":"security-advisories@github.com"},{"url":"https://github.com/nextflow-io/nextflow/security/advisories/GHSA-92qf-fcph-v5wr","label":"security-advisories@github.com"},{"url":"https://github.com/advisories/GHSA-92qf-fcph-v5wr"}],"tags":["nvd","cve.org","ghsa","maven"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-17T14:28:06.186459Z"},"epss":0.001,"epssPercentile":0.0098,"ecosystem":"maven","ingestedAt":"2026-06-26T16:43:14.217Z","slug":"CVE-2026-48722","body":"## Overview\n\nNextflow is a DSL for data-driven computational pipelines. From 25.09.2-edge until 25.10.6 and 26.04.3, nextflow auth login writes Seqera Platform OIDC bearer tokens to ${NXF_HOME:-~/.nextflow}/seqera-auth.config through AuthCommandImpl.writeConfig in plugins/nf-tower/src/main/io/seqera/tower/plugin/auth/AuthCommandImpl.groovy without setting restrictive file permissions, allowing the default umask 022 to create the file with mode 0644. On a multi-user POSIX host, a local user who can traverse the victim's home directory can read seqera-auth.config and impersonate the victim against Seqera Platform within the token's scope. Single-user systems and headless CI runners that do not use the interactive login flow are not affected. This issue is fixed in 25.10.6 and 26.04.3.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-48722)\n\nAffected packages:\n\n- `io.nextflow:nextflow >= 25.09.2-edge, < 25.10.6`\n- `io.nextflow:nextflow >= 26.00.0-edge, < 26.04.3`\n\nPatched in:\n\n- `io.nextflow:nextflow 25.10.6`\n- `io.nextflow:nextflow 26.04.3`\n\nSource: https://github.com/advisories/GHSA-92qf-fcph-v5wr","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":30.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}