Data-Driven Computational Pipeline Vulnerability in Nextflow by Seqera

CVE-2026-48722

What is CVE-2026-48722?

The Nextflow platform contains a vulnerability that allows unauthorized users to access OIDC bearer tokens stored in a configuration file. When Nextflow's authentication command writes to the seqera-auth.config file located in the user's home directory, it does so without setting restrictive file permissions. As a result, local users on a multi-user system can traverse the owner's home directory and read sensitive information from this file, potentially impersonating the user against the Seqera Platform. This vulnerability affects specific versions of Nextflow but is resolved in subsequent updates.

References