---
id: CVE-2026-46388
title: >-
  osquery is a SQL powered operating system instrumentation, monitoring, and
  analytics framework
summary: >-
  osquery is a SQL powered operating system instrumentation, monitoring, and
  analytics framework. Prior to 5.23.1, an unprivileged attacker can read the
  contents of an osquery file carve until the carve completes and the temporary
  files ar…
severity: medium
cvss: 4.4
cvssVector: 'CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N'
cwe:
  - CWE-279
  - CWE-378
  - CWE-379
published: '2026-07-10'
updated: '2026-07-10'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-46388'
references:
  - url: >-
      https://github.com/osquery/osquery/commit/6dabe9ded33bf9c6fc0f3e37ec364a1cbbd25d68
    label: security-advisories@github.com
  - url: 'https://github.com/osquery/osquery/pull/8961'
    label: security-advisories@github.com
  - url: 'https://github.com/osquery/osquery/releases/tag/5.23.1'
    label: security-advisories@github.com
  - url: 'https://github.com/osquery/osquery/security/advisories/GHSA-fg78-9q98-62hh'
    label: security-advisories@github.com
tags:
  - nvd
epss: 0.00126
epssPercentile: 0.01923
ingestedAt: '2026-07-11T20:15:26.018Z'
---

## Overview

osquery is a SQL powered operating system instrumentation, monitoring, and analytics framework. Prior to 5.23.1, an unprivileged attacker can read the contents of an osquery file carve until the carve completes and the temporary files are deleted because in-progress carve directories are not created with private permissions. If the carve targets a directory that the attacker controls, arbitrary file reads are possible, such as sensitive local files. This issue is fixed in version 5.23.1.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.