Executive brief
Nextflow is a workflow tool used for data-intensive scientific pipelines. A security issue in the 'auth login' command causes authentication tokens to be saved with insecure file permissions on shared systems. This allows other local users on the same computer to steal these tokens and impersonate the victim on the Seqera Platform.
Technical details
The 'nextflow auth login' command persists Seqera Platform OIDC tokens to a configuration file using Java NIO without explicitly defining file permissions. On POSIX systems with a default umask of 022, the resulting file is created with mode 0644 (world-readable). A local attacker with directory traversal access can read the 'seqera-auth.config' file to obtain a valid bearer token. This enables impersonation of the victim within the token's scope on the Seqera Platform. The vulnerability is fixed in versions 25.10.6 and 26.04.3 by enforcing mode 0600 on the configuration file.
Affected products
- nextflow-io nextflow >= 25.09.2-edge, < 25.10.6; >= 25.11.0-edge, < 26.04.3
Timeline
- 2026-06-08: disclosed
- 2026-06-25: advisory