io.nextflow/nextflow vulnerabilities

Latest io.nextflow/nextflow CVEs

Newest publication first

1. CVE-2026-48722 Nextflow: Incorrect default permissions in the nextflow auth login command

   Published 2026-09-15

   Medium·CVSS 5.5 EPSS 0.14%

   Nextflow is a DSL for data-driven computational pipelines. From 25.09.2-edge until 25.10.6 and 26.04.3, nextflow auth login writes Seqera Platform OIDC bearer tokens to ${NXF_HOME:-~/.nextflow}/seqera-auth.config through AuthCommandImpl.writeConfig in plugins/nf-tower/src/main/io...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.