Loading vulnerability…
CVE-2026-48722 is an incorrect default permissions issue in Nextflow affecting the auth login workflow. On multi-user POSIX systems, the interactive nextflow auth login command may store a Seqera Platform OIDC/bearer token in seqera-auth.config under the Nextflow home directory with overly permissive filesystem permissions, making the file world-readable to other local users. The vulnerable condition is the insecure creation or retention of the token-bearing configuration file rather than a memory corruption flaw or remote code execution bug. The issue affects confidentiality of authentication material by exposing a valid platform token to unauthorized local users on the same host.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
seqera-auth.config, recover a valid Seqera Platform bearer token, and impersonate the victim to Seqera Platform within the scope and lifetime of that token. This can enable unauthorized access to platform resources and actions permitted by the compromised token. Based on the provided advisory, single-user systems and headless CI runners that do not use the interactive login flow are not affected.If you can’t patch tonight, do this now.
chmod 600 "${NXF_HOME:-$HOME/.nextflow}/seqera-auth.config" and chmod 700 "${NXF_HOME:-$HOME/.nextflow}". As an alternative, avoid the interactive login flow and supply the Platform token via the TOWER_ACCESS_TOKEN environment variable instead of using nextflow auth login. Any previously stored tokens should be treated as disclosed and rotated or revoked.Patch, then assume compromise.
25.10.6 or later. According to the advisory, this version applies mode 0600 to seqera-auth.config after writing and on subsequent logins. After upgrading, invalidate any potentially exposed credentials by running nextflow auth logout, revoking the token in the Seqera Platform UI, and then running nextflow auth login again to obtain a new token.No public exploits tracked yet. Mallory keeps watching.
No public exploit code observed for this vulnerability.
No public activity tracked yet. Mallory keeps watching.
No public activity observed for this vulnerability.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.