GHSA-65R4-943X-97JJ vulnerabilities

Vulnerabilities for packages: nextflow, spdx-tools-java, opensearch, apache-tika...

CVE-2026-75140 vulnerabilities

Vulnerabilities for packages: nextflow, spdx-tools-java, opensearch, apache-tika...

CVE-2026-48722

Nextflow is a DSL for data-driven computational pipelines. From 25.09.2-edge until 25.10.6 and 26.04.3, nextflow auth login writes Seqera Platform OIDC bearer tokens to $NXFHOME:-/.nextflow/seqera-auth.config through AuthCommandImpl.writeConfig in...

CVE-2026-48722 Nextflow: Incorrect default permissions in the nextflow auth login command

Nextflow is a DSL for data-driven computational pipelines. From 25.09.2-edge until 25.10.6 and 26.04.3, nextflow auth login writes Seqera Platform OIDC bearer tokens to $NXFHOME:-/.nextflow/seqera-auth.config through AuthCommandImpl.writeConfig in...

CVE-2026-48722

Nextflow (a DSL for data-driven computational pipelines) contains an incorrect default permissions flaw (CWE-276) in the nextflow auth login command. The Seqera Platform OIDC bearer token is written to ${NXF_HOME:-~/.nextflow}/seqera-auth.config via Java NIO without setting restrictive file permi...

CVE-2026-48722 Nextflow: Incorrect default permissions in the nextflow auth login command

Nextflow is a DSL for data-driven computational pipelines. From 25.09.2-edge until 25.10.6 and 26.04.3, nextflow auth login writes Seqera Platform OIDC bearer tokens to $NXFHOME:-/.nextflow/seqera-auth.config through AuthCommandImpl.writeConfig in...

EUVD-2026-78578

Nextflow is a DSL for data-driven computational pipelines. From 25.09.2-edge until 25.10.6 and 26.04.3, nextflow auth login writes Seqera Platform OIDC bearer tokens to $NXFHOME:-/.nextflow/seqera-auth.config through AuthCommandImpl.writeConfig in...

CVE-2026-48722 Nextflow: Incorrect default permissions in the nextflow auth login command

Nextflow is a DSL for data-driven computational pipelines. From 25.09.2-edge until 25.10.6 and 26.04.3, nextflow auth login writes Seqera Platform OIDC bearer tokens to $NXFHOME:-/.nextflow/seqera-auth.config through AuthCommandImpl.writeConfig in...

CVE-2026-48722: Incorrect Default Permissions

Nextflow is a DSL for data-driven computational pipelines. From 25.09.2-edge until 25.10.6 and 26.04.3, nextflow auth login writes Seqera Platform OIDC bearer tokens to $NXFHOME:-/.nextflow/seqera-auth.config through AuthCommandImpl.writeConfig in...

CVE-2026-71497 vulnerabilities

Vulnerabilities for packages: copybara, wazuh-indexer, apache-tika, metabase, nextflow, conductor, opensearch-fips, conductor-fips, elasticsearch, gradle, apache-hop, jbang, apache-hop-fips, jmeter, copybara-fips, spdx-tools-java, scala, opensearch, elasticsearch-fips, apache-tika-fips...

GHSA-PMHH-3W7G-XQP8 vulnerabilities

Vulnerabilities for packages: copybara, wazuh-indexer, apache-tika, metabase, nextflow, conductor, opensearch-fips, conductor-fips, elasticsearch, gradle, apache-hop, jbang, apache-hop-fips, jmeter, copybara-fips, spdx-tools-java, scala, opensearch, elasticsearch-fips, apache-tika-fips...

CVE-2026-71497 vulnerabilities

Vulnerabilities for packages: nextflow, opensearch, apache-tika, gradle, spdx-tools-java...

GHSA-PMHH-3W7G-XQP8 vulnerabilities

Vulnerabilities for packages: nextflow, opensearch, apache-tika, gradle, spdx-tools-java...

GHSA-P47F-322F-WHFH vulnerabilities

Vulnerabilities for packages: cassandra-fips, management-api-for-apache-cassandra-5.0, nacos, ranger, dependency-track-apiserver, kafbat-ui, airbyte-server-fips, kafbat-ui-fips, nextflow, airbyte-server, cassandra-reaper, management-api-for-apache-cassandra-4.0, knative-kafka-broker, trino,...

CVE-2026-9828 vulnerabilities

Vulnerabilities for packages: cassandra-fips, management-api-for-apache-cassandra-5.0, nacos, ranger, dependency-track-apiserver, kafbat-ui, airbyte-server-fips, kafbat-ui-fips, nextflow, airbyte-server, cassandra-reaper, management-api-for-apache-cassandra-4.0, knative-kafka-broker, trino,...

GHSA-P47F-322F-WHFH vulnerabilities

Vulnerabilities for packages: keycloak-config-cli, akhq, sonar-scanner-cli, nextflow, cassandra-reaper, cassandra, kserve-modelmesh, sonarqube, zookeeper, dependency-track, management-api-for-apache-cassandra-5.0, trino...

CVE-2026-9828 vulnerabilities

Vulnerabilities for packages: keycloak-config-cli, akhq, sonar-scanner-cli, nextflow, cassandra-reaper, cassandra, kserve-modelmesh, sonarqube, zookeeper, dependency-track, management-api-for-apache-cassandra-5.0, trino...

nextflow auth login command has incorrect default permissions

Impact nextflow auth login persists Seqera Platform OIDC tokens to $NXFHOME:-/.nextflow/seqera-auth.config. The file is created via Java NIO without specifying file permissions, so under the default umask 022 it lands at mode 0644 world-readable. On a multi-user POSIX host — typically an HPC logi...

GHSA-92QF-FCPH-V5WR nextflow auth login command has incorrect default permissions

Impact nextflow auth login persists Seqera Platform OIDC tokens to $NXFHOME:-/.nextflow/seqera-auth.config. The file is created via Java NIO without specifying file permissions, so under the default umask 022 it lands at mode 0644 world-readable. On a multi-user POSIX host — typically an HPC logi...

PT-2026-52646

Name of the Vulnerable Software and Affected Versions Nextflow versions 25.09.2-edge through 26.04.1 Description The nextflow auth login command persists Seqera Platform OIDC tokens to the $NXF HOME:-/.nextflow/seqera-auth.config file. Because the file is created via Java NIO without specifying...