Detections
Analytics
SCA: security update for io.nextflow:nextflow (GHSA-92qf-fcph-v5wr)
medium Tenable Cloud Security Plugin ID 443955
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- Nextflow is a DSL for data-driven computational pipelines. From 25.09.2-edge until 25.10.6 and 26.04.3,
nextflow auth login writes Seqera Platform OIDC bearer tokens to ${NXF_HOME:-~/.nextflow}/seqera-
auth.config through AuthCommandImpl.writeConfig in plugins/nf-
tower/src/main/io/seqera/tower/plugin/auth/AuthCommandImpl.groovy without setting restrictive file
permissions, allowing the default umask 022 to create the file with mode 0644. On a multi-user POSIX host,
a local user who can traverse the victim's home directory can read seqera-auth.config and impersonate the
victim against Seqera Platform within the token's scope. Single-user systems and headless CI runners that
do not use the interactive login flow are not affected. This issue is fixed in 25.10.6 and 26.04.3.
(CVE-2026-48722)
Solution
Update the io.nextflow:nextflow library and its related packages to version 25.10.6 or later.See Also
Plugin Details
Severity: Medium
ID: 443955
Version: Revision 1.4
Type: Local
Family: SCA Checks
Published: 6/26/2026
Updated: 9/16/2026
Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Low
Score: 3
Percentile: 23.71
Vendor
Vendor Severity: Medium
CVSS v2
Risk Factor: Medium
Base Score: 4.6
Temporal Score: 3.4
Vector: CVSS2#AV:L/AC:L/Au:S/C:C/I:N/A:N
CVSS Score Source: CVE-2026-48722
CVSS v3
Risk Factor: Medium
Base Score: 5.5
Temporal Score: 4.8
Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
Exploit Ease: No known exploits are available
Patch Publication Date: 6/25/2026
Vulnerability Publication Date: 6/25/2026
Reference Information
CVE: CVE-2026-48722