22 matches found
CVE-2026-48722
Nextflow is a DSL for data-driven computational pipelines. From 25.09.2-edge until 25.10.6 and 26.04.3, nextflow auth login writes Seqera Platform OIDC bearer tokens to $NXFHOME:-/.nextflow/seqera-auth.config through AuthCommandImpl.writeConfig in...
CVE-2026-48722 Nextflow: Incorrect default permissions in the nextflow auth login command
Nextflow is a DSL for data-driven computational pipelines. From 25.09.2-edge until 25.10.6 and 26.04.3, nextflow auth login writes Seqera Platform OIDC bearer tokens to $NXFHOME:-/.nextflow/seqera-auth.config through AuthCommandImpl.writeConfig in...
CVE-2026-48722 Nextflow: Incorrect default permissions in the nextflow auth login command
Nextflow is a DSL for data-driven computational pipelines. From 25.09.2-edge until 25.10.6 and 26.04.3, nextflow auth login writes Seqera Platform OIDC bearer tokens to $NXFHOME:-/.nextflow/seqera-auth.config through AuthCommandImpl.writeConfig in...
CVE-2026-48722 Nextflow: Incorrect default permissions in the nextflow auth login command
Nextflow is a DSL for data-driven computational pipelines. From 25.09.2-edge until 25.10.6 and 26.04.3, nextflow auth login writes Seqera Platform OIDC bearer tokens to $NXFHOME:-/.nextflow/seqera-auth.config through AuthCommandImpl.writeConfig in...
CVE-2026-48722
Nextflow (a DSL for data-driven computational pipelines) contains an incorrect default permissions flaw (CWE-276) in the nextflow auth login command. The Seqera Platform OIDC bearer token is written to ${NXF_HOME:-~/.nextflow}/seqera-auth.config via Java NIO without setting restrictive file permi...
EUVD-2026-78578
Nextflow is a DSL for data-driven computational pipelines. From 25.09.2-edge until 25.10.6 and 26.04.3, nextflow auth login writes Seqera Platform OIDC bearer tokens to $NXFHOME:-/.nextflow/seqera-auth.config through AuthCommandImpl.writeConfig in...
CVE-2026-48722: Incorrect Default Permissions
Nextflow is a DSL for data-driven computational pipelines. From 25.09.2-edge until 25.10.6 and 26.04.3, nextflow auth login writes Seqera Platform OIDC bearer tokens to $NXFHOME:-/.nextflow/seqera-auth.config through AuthCommandImpl.writeConfig in...
GHSA-PMHH-3W7G-XQP8 vulnerabilities
Vulnerabilities for packages: apache-hop, copybara, apache-tika, copybara-fips, nextflow, gradle, jbang, scala, metabase, apache-hop-fips, elasticsearch-fips, elasticsearch, conductor-fips, conductor, apache-tika-fips, wazuh-indexer, spdx-tools-java, opensearch, opensearch-fips...
CVE-2026-71497 vulnerabilities
Vulnerabilities for packages: apache-hop, copybara, apache-tika, copybara-fips, nextflow, gradle, jbang, scala, metabase, apache-hop-fips, elasticsearch-fips, elasticsearch, conductor-fips, conductor, apache-tika-fips, wazuh-indexer, spdx-tools-java, opensearch, opensearch-fips...
GHSA-PMHH-3W7G-XQP8 vulnerabilities
Vulnerabilities for packages: opensearch, apache-tika, spdx-tools-java, nextflow, gradle...
CVE-2026-71497 vulnerabilities
Vulnerabilities for packages: opensearch, apache-tika, spdx-tools-java, nextflow, gradle...
GHSA-P47F-322F-WHFH vulnerabilities
Vulnerabilities for packages: airbyte-server, management-api-for-apache-cassandra-4.0, kserve-modelmesh, nextflow, cassandra-fips, ontop-fips, cassandra, trino, dependency-track-apiserver, nacos, kafbat-ui-fips, management-api-for-apache-cassandra-5.0, sonarqube, sonar-scanner-cli,...
CVE-2026-9828 vulnerabilities
Vulnerabilities for packages: airbyte-server, management-api-for-apache-cassandra-4.0, kserve-modelmesh, nextflow, cassandra-fips, ontop-fips, cassandra, trino, dependency-track-apiserver, nacos, kafbat-ui-fips, management-api-for-apache-cassandra-5.0, sonarqube, sonar-scanner-cli,...
GHSA-P47F-322F-WHFH vulnerabilities
Vulnerabilities for packages: keycloak-config-cli, kserve-modelmesh, zookeeper, akhq, management-api-for-apache-cassandra-5.0, sonar-scanner-cli, sonarqube, nextflow, dependency-track, cassandra, trino, cassandra-reaper...
CVE-2026-9828 vulnerabilities
Vulnerabilities for packages: keycloak-config-cli, kserve-modelmesh, zookeeper, akhq, management-api-for-apache-cassandra-5.0, sonar-scanner-cli, sonarqube, nextflow, dependency-track, cassandra, trino, cassandra-reaper...
nextflow auth login command has incorrect default permissions
Impact nextflow auth login persists Seqera Platform OIDC tokens to $NXFHOME:-/.nextflow/seqera-auth.config. The file is created via Java NIO without specifying file permissions, so under the default umask 022 it lands at mode 0644 world-readable. On a multi-user POSIX host — typically an HPC logi...
GHSA-92QF-FCPH-V5WR nextflow auth login command has incorrect default permissions
Impact nextflow auth login persists Seqera Platform OIDC tokens to $NXFHOME:-/.nextflow/seqera-auth.config. The file is created via Java NIO without specifying file permissions, so under the default umask 022 it lands at mode 0644 world-readable. On a multi-user POSIX host — typically an HPC logi...
PT-2026-52646
Name of the Vulnerable Software and Affected Versions Nextflow versions 25.09.2-edge through 26.04.1 Description The nextflow auth login command persists Seqera Platform OIDC tokens to the $NXF HOME:-/.nextflow/seqera-auth.config file. Because the file is created via Java NIO without specifying...