Answer in brief
CVE-2026-48722 records a Medium severity vulnerability in Nextflow: Incorrect default permissions in the nextflow auth login command. The current sources do not mark it as known exploited. The current feed maps nextflow-io/nextflow (generic), io.nextflow:nextflow (maven), io.nextflow:nextflow (maven). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps nextflow-io/nextflow (generic), io.nextflow:nextflow (maven), io.nextflow:nextflow (maven). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| nextflow-io/nextflowgeneric | >= 25.09.2-edge, < 25.10.6 || >= 25.11.0-edge, < 26.04.3 | Not reported |
| io.nextflow:nextflowmaven | >=25.09.2-edge,<25.10.6 | 25.10.6 |
| io.nextflow:nextflowmaven | >=26.00.0-edge,<26.04.3 | 26.04.3 |
Published upstream
Sep 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Sep 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Jun 25, 2026
Nextflow is a DSL for data-driven computational pipelines. From 25.09.2-edge until 25.10.6 and 26.04.3, nextflow auth login writes Seqera Platform OIDC bearer tokens to ${NXF_HOME:-~/.nextflow}/seqera-auth.config through AuthCommandImpl.writeConfig in plugins/nf-tower/src/main/io/seqera/tower/plugin/auth/AuthCommandImpl.groovy without setting restrictive file permissions, allowing the default umask 022 to create the file with mode 0644. On a multi-user POSIX host, a local user who can traverse the victim's home directory can read seqera-auth.config and impersonate the victim against Seqera Platform within the token's scope. Single-user systems and headless CI runners that do not use the interactive login flow are not affected. This issue is fixed in 25.10.6 and 26.04.3.
Quoted source text, attributed separately from HOL analysis.