22 matches found
CVE-2026-48722
Nextflow is a DSL for data-driven computational pipelines. From 25.09.2-edge until 25.10.6 and 26.04.3, nextflow auth login writes Seqera Platform OIDC bearer tokens to $NXFHOME:-/.nextflow/seqera-auth.config through AuthCommandImpl.writeConfig in...
CVE-2026-48722 Nextflow: Incorrect default permissions in the nextflow auth login command
Nextflow is a DSL for data-driven computational pipelines. From 25.09.2-edge until 25.10.6 and 26.04.3, nextflow auth login writes Seqera Platform OIDC bearer tokens to $NXFHOME:-/.nextflow/seqera-auth.config through AuthCommandImpl.writeConfig in...
CVE-2026-48722 Nextflow: Incorrect default permissions in the nextflow auth login command
Nextflow is a DSL for data-driven computational pipelines. From 25.09.2-edge until 25.10.6 and 26.04.3, nextflow auth login writes Seqera Platform OIDC bearer tokens to $NXFHOME:-/.nextflow/seqera-auth.config through AuthCommandImpl.writeConfig in...
EUVD-2026-78578
Nextflow is a DSL for data-driven computational pipelines. From 25.09.2-edge until 25.10.6 and 26.04.3, nextflow auth login writes Seqera Platform OIDC bearer tokens to $NXFHOME:-/.nextflow/seqera-auth.config through AuthCommandImpl.writeConfig in...
CVE-2026-48722 Nextflow: Incorrect default permissions in the nextflow auth login command
Nextflow is a DSL for data-driven computational pipelines. From 25.09.2-edge until 25.10.6 and 26.04.3, nextflow auth login writes Seqera Platform OIDC bearer tokens to $NXFHOME:-/.nextflow/seqera-auth.config through AuthCommandImpl.writeConfig in...
CVE-2026-48722
Nextflow (a DSL for data-driven computational pipelines) contains an incorrect default permissions flaw (CWE-276) in the nextflow auth login command. The Seqera Platform OIDC bearer token is written to ${NXF_HOME:-~/.nextflow}/seqera-auth.config via Java NIO without setting restrictive file permi...
CVE-2026-48722: Incorrect Default Permissions
Nextflow is a DSL for data-driven computational pipelines. From 25.09.2-edge until 25.10.6 and 26.04.3, nextflow auth login writes Seqera Platform OIDC bearer tokens to $NXFHOME:-/.nextflow/seqera-auth.config through AuthCommandImpl.writeConfig in...
GHSA-PMHH-3W7G-XQP8 vulnerabilities
Vulnerabilities for packages: gradle, copybara, wazuh-indexer, copybara-fips, opensearch-fips, elasticsearch-fips, spdx-tools-java, jbang, apache-hop-fips, scala, apache-tika-fips, metabase, apache-tika, conductor-fips, opensearch, apache-hop, elasticsearch, nextflow, conductor...
CVE-2026-71497 vulnerabilities
Vulnerabilities for packages: gradle, copybara, wazuh-indexer, copybara-fips, opensearch-fips, elasticsearch-fips, spdx-tools-java, jbang, apache-hop-fips, scala, apache-tika-fips, metabase, apache-tika, conductor-fips, opensearch, apache-hop, elasticsearch, nextflow, conductor...
GHSA-PMHH-3W7G-XQP8 vulnerabilities
Vulnerabilities for packages: opensearch, spdx-tools-java, nextflow, gradle, apache-tika...
CVE-2026-71497 vulnerabilities
Vulnerabilities for packages: opensearch, spdx-tools-java, nextflow, gradle, apache-tika...
GHSA-P47F-322F-WHFH vulnerabilities
Vulnerabilities for packages: s3proxy, management-api-for-apache-cassandra-5.0, localstack, management-api-for-apache-cassandra-4.1, trino, akhq, kafbat-ui, kafbat-ui-fips, airbyte-server-fips, kserve-modelmesh, knative-kafka-broker-fips, hadoop-fips, airbyte-server,...
CVE-2026-9828 vulnerabilities
Vulnerabilities for packages: s3proxy, management-api-for-apache-cassandra-5.0, localstack, management-api-for-apache-cassandra-4.1, trino, akhq, kafbat-ui, kafbat-ui-fips, airbyte-server-fips, kserve-modelmesh, knative-kafka-broker-fips, hadoop-fips, airbyte-server,...
CVE-2026-9828 vulnerabilities
Vulnerabilities for packages: cassandra, cassandra-reaper, keycloak-config-cli, kserve-modelmesh, dependency-track, zookeeper, management-api-for-apache-cassandra-5.0, sonarqube, trino, nextflow, sonar-scanner-cli, akhq...
GHSA-P47F-322F-WHFH vulnerabilities
Vulnerabilities for packages: cassandra, cassandra-reaper, keycloak-config-cli, kserve-modelmesh, dependency-track, zookeeper, management-api-for-apache-cassandra-5.0, sonarqube, trino, nextflow, sonar-scanner-cli, akhq...
nextflow auth login command has incorrect default permissions
Impact nextflow auth login persists Seqera Platform OIDC tokens to $NXFHOME:-/.nextflow/seqera-auth.config. The file is created via Java NIO without specifying file permissions, so under the default umask 022 it lands at mode 0644 world-readable. On a multi-user POSIX host — typically an HPC logi...
GHSA-92QF-FCPH-V5WR nextflow auth login command has incorrect default permissions
Impact nextflow auth login persists Seqera Platform OIDC tokens to $NXFHOME:-/.nextflow/seqera-auth.config. The file is created via Java NIO without specifying file permissions, so under the default umask 022 it lands at mode 0644 world-readable. On a multi-user POSIX host — typically an HPC logi...
PT-2026-52646
Name of the Vulnerable Software and Affected Versions Nextflow versions 25.09.2-edge through 26.04.1 Description The nextflow auth login command persists Seqera Platform OIDC tokens to the $NXF HOME:-/.nextflow/seqera-auth.config file. Because the file is created via Java NIO without specifying...