GHSA-65R4-943X-97JJ vulnerabilities

Vulnerabilities for packages: nextflow, opensearch, spdx-tools-java, apache-tika...

CVE-2026-75140 vulnerabilities

Vulnerabilities for packages: nextflow, opensearch, spdx-tools-java, apache-tika...

CVE-2026-48722

Nextflow is a DSL for data-driven computational pipelines. From 25.09.2-edge until 25.10.6 and 26.04.3, nextflow auth login writes Seqera Platform OIDC bearer tokens to $NXFHOME:-/.nextflow/seqera-auth.config through AuthCommandImpl.writeConfig in...

EUVD-2026-78578

Nextflow is a DSL for data-driven computational pipelines. From 25.09.2-edge until 25.10.6 and 26.04.3, nextflow auth login writes Seqera Platform OIDC bearer tokens to $NXFHOME:-/.nextflow/seqera-auth.config through AuthCommandImpl.writeConfig in...

CVE-2026-48722 Nextflow: Incorrect default permissions in the nextflow auth login command

Nextflow is a DSL for data-driven computational pipelines. From 25.09.2-edge until 25.10.6 and 26.04.3, nextflow auth login writes Seqera Platform OIDC bearer tokens to $NXFHOME:-/.nextflow/seqera-auth.config through AuthCommandImpl.writeConfig in...

CVE-2026-48722

Nextflow (a DSL for data-driven computational pipelines) contains an incorrect default permissions flaw (CWE-276) in the nextflow auth login command. The Seqera Platform OIDC bearer token is written to ${NXF_HOME:-~/.nextflow}/seqera-auth.config via Java NIO without setting restrictive file permi...

CVE-2026-48722 Nextflow: Incorrect default permissions in the nextflow auth login command

Nextflow is a DSL for data-driven computational pipelines. From 25.09.2-edge until 25.10.6 and 26.04.3, nextflow auth login writes Seqera Platform OIDC bearer tokens to $NXFHOME:-/.nextflow/seqera-auth.config through AuthCommandImpl.writeConfig in...

CVE-2026-48722 Nextflow: Incorrect default permissions in the nextflow auth login command

Nextflow is a DSL for data-driven computational pipelines. From 25.09.2-edge until 25.10.6 and 26.04.3, nextflow auth login writes Seqera Platform OIDC bearer tokens to $NXFHOME:-/.nextflow/seqera-auth.config through AuthCommandImpl.writeConfig in...

CVE-2026-48722: Incorrect Default Permissions

Nextflow is a DSL for data-driven computational pipelines. From 25.09.2-edge until 25.10.6 and 26.04.3, nextflow auth login writes Seqera Platform OIDC bearer tokens to $NXFHOME:-/.nextflow/seqera-auth.config through AuthCommandImpl.writeConfig in...

GHSA-PMHH-3W7G-XQP8 vulnerabilities

Vulnerabilities for packages: spdx-tools-java, apache-tika-fips, jmeter, apache-tika, jbang, gradle, elasticsearch, copybara, metabase, nextflow, apache-hop, copybara-fips, conductor-fips, scala, conductor, elasticsearch-fips, apache-hop-fips, wazuh-indexer, opensearch-fips, opensearch...

CVE-2026-71497 vulnerabilities

Vulnerabilities for packages: spdx-tools-java, apache-tika-fips, jmeter, apache-tika, jbang, gradle, elasticsearch, copybara, metabase, nextflow, apache-hop, copybara-fips, conductor-fips, scala, conductor, elasticsearch-fips, apache-hop-fips, wazuh-indexer, opensearch-fips, opensearch...

GHSA-PMHH-3W7G-XQP8 vulnerabilities

Vulnerabilities for packages: spdx-tools-java, opensearch, gradle, nextflow, apache-tika...

CVE-2026-71497 vulnerabilities

Vulnerabilities for packages: spdx-tools-java, opensearch, gradle, nextflow, apache-tika...

GHSA-P47F-322F-WHFH vulnerabilities

Vulnerabilities for packages: airbyte-server, akhq, management-api-for-apache-cassandra-4.0, sonar-scanner-cli, zookeeper, ranger, ontop-fips, cassandra-reaper, nacos, cassandra, sonarqube, kafbat-ui, management-api-for-apache-cassandra-4.1, airbyte-server-fips, nextflow, s3proxy-fips, hadoop-fip...

CVE-2026-9828 vulnerabilities

Vulnerabilities for packages: airbyte-server, akhq, management-api-for-apache-cassandra-4.0, sonar-scanner-cli, zookeeper, ranger, ontop-fips, cassandra-reaper, nacos, cassandra, sonarqube, kafbat-ui, management-api-for-apache-cassandra-4.1, airbyte-server-fips, nextflow, s3proxy-fips, hadoop-fip...

GHSA-P47F-322F-WHFH vulnerabilities

Vulnerabilities for packages: zookeeper, kserve-modelmesh, trino, keycloak-config-cli, dependency-track, akhq, nextflow, sonarqube, cassandra-reaper, sonar-scanner-cli, management-api-for-apache-cassandra-5.0, cassandra...

CVE-2026-9828 vulnerabilities

Vulnerabilities for packages: zookeeper, kserve-modelmesh, trino, keycloak-config-cli, dependency-track, akhq, nextflow, sonarqube, cassandra-reaper, sonar-scanner-cli, management-api-for-apache-cassandra-5.0, cassandra...

GHSA-92QF-FCPH-V5WR nextflow auth login command has incorrect default permissions

Impact nextflow auth login persists Seqera Platform OIDC tokens to $NXFHOME:-/.nextflow/seqera-auth.config. The file is created via Java NIO without specifying file permissions, so under the default umask 022 it lands at mode 0644 world-readable. On a multi-user POSIX host — typically an HPC logi...

nextflow auth login command has incorrect default permissions

Impact nextflow auth login persists Seqera Platform OIDC tokens to $NXFHOME:-/.nextflow/seqera-auth.config. The file is created via Java NIO without specifying file permissions, so under the default umask 022 it lands at mode 0644 world-readable. On a multi-user POSIX host — typically an HPC logi...

PT-2026-52646

Name of the Vulnerable Software and Affected Versions Nextflow versions 25.09.2-edge through 26.04.1 Description The nextflow auth login command persists Seqera Platform OIDC tokens to the $NXF HOME:-/.nextflow/seqera-auth.config file. Because the file is created via Java NIO without specifying...