Description

Nextflow is a DSL for data-driven computational pipelines. From 25.09.2-edge until 25.10.6 and 26.04.3, nextflow auth login writes Seqera Platform OIDC bearer tokens to ${NXF_HOME:-~/.nextflow}/seqera-auth.config through AuthCommandImpl.writeConfig in plugins/nf-tower/src/main/io/seqera/tower/plugin/auth/AuthCommandImpl.groovy without setting restrictive file permissions, allowing the default umask 022 to create the file with mode 0644. On a multi-user POSIX host, a local user who can traverse the victim's home directory can read seqera-auth.config and impersonate the victim against Seqera Platform within the token's scope. Single-user systems and headless CI runners that do not use the interactive login flow are not affected. This issue is fixed in 25.10.6 and 26.04.3.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.5",
  "pubDate": "2026-09-15T15:17:16.020Z",
  "pubdate": "2026-09-15T15:17:16.020Z",
  "executiveSummary": "Nextflow versions 25.09.2-edge through 25.10.5 and 26.04.2 suffer from an insecure file permission vulnerability related to OIDC bearer token storage.\nThe application stores sensitive authentication tokens in a plain-text configuration file, seqera-auth.config, within the user's home directory.\nDue to the failure to restrict file permissions at the time of creation, the resulting file inherits the system's default umask (typically 022), rendering the file world-readable on multi-user POSIX environments.\nThis vulnerability allows local unprivileged attackers to harvest OIDC bearer tokens belonging to other users.\nSuccessful exploitation enables an attacker to impersonate the victim against the Seqera Platform, potentially leading to unauthorized access to sensitive computational pipelines and data.\nSystems impacted include multi-user POSIX environments where users share a host filesystem; single-user systems and non-interactive headless CI runners are generally not at risk.",
  "technicalDetails": "The root cause of this vulnerability lies in the implementation of the AuthCommandImpl.writeConfig method located in plugins/nf-tower/src/main/io/seqera/tower/plugin/auth/AuthCommandImpl.groovy.\nWhen a user performs an interactive login flow, Nextflow writes the OIDC bearer token to ${NXF_HOME:-~/.nextflow}/seqera-auth.config to maintain the authentication state.\nThe implementation fails to explicitly define filesystem permissions (such as 0600) upon file creation. Consequently, the operating system applies the default process umask (022).\nOn standard POSIX-compliant systems, a umask of 022 results in files being created with 0644 permissions (rw-r--r--), granting read access to all users on the system.\nThe attack flow proceeds as follows: 1) An attacker on a multi-user POSIX system identifies the target user's Nextflow configuration directory, typically located at ~/.nextflow. 2) If the target user has performed an interactive login, the seqera-auth.config file exists with permissive read access. 3) The attacker navigates to the target's directory and reads the contents of the seqera-auth.config file to extract the OIDC bearer token. 4) The attacker utilizes the stolen token to authenticate to the Seqera Platform, masquerading as the victim.\nBecause the token remains valid until its expiration or revocation, the attacker gains the full scope of the victim's privileges within the Seqera Platform, including the ability to view, modify, or execute computational pipelines.\nThe vulnerable component is identified as the nf-tower plugin within the Nextflow codebase. Affected versions range from 25.09.2-edge up to, but not including, the patched versions 25.10.6 and 26.04.3.\nExploitation does not require elevated administrative privileges, only local access to the filesystem and the ability to traverse the victim's home directory, which is a common occurrence in shared computational clusters or development environments.\nPost-exploitation impact includes complete account compromise within the context of the Seqera Platform, potentially leading to data exfiltration or the injection of malicious code into computational workflows."
}