CVE-2026-46388

osquery is a SQL powered operating system instrumentation, monitoring, and analytics framework. Prior to 5.23.1, an unprivileged attacker can read the contents of an osquery file carve until the carve completes and the temporary files are deleted because in-progress carve directories are not created with private permissions. If the carve targets a directory that the attacker controls, arbitrary file reads are possible, such as sensitive local files. This issue is fixed in version 5.23.1.

CVSS v3 4.4 MEDIUM

4.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 0.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/osquery/osquery/commit/6dabe9ded33bf9c6fc0f3e37ec364a1cbbd25d68
https://github.com/osquery/osquery/pull/8961
https://github.com/osquery/osquery/releases/tag/5.23.1
https://github.com/osquery/osquery/security/advisories/GHSA-fg78-9q98-62hh

Configurations

No configuration.

History

10 Jul 2026, 16:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-07-10 16:16

Updated : 2026-07-10 20:16

NVD link : CVE-2026-46388

Mitre link : CVE-2026-46388

CVE.ORG link : CVE-2026-46388

JSON object : View

Products Affected

No product.

CWE

CWE-279

Incorrect Execution-Assigned Permissions

CWE-378

Creation of Temporary File With Insecure Permissions

CWE-379

Creation of Temporary File in Directory with Insecure Permissions

{"id": "CVE-2026-46388", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-46388", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-10T19:03:00.746306Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.4, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 0.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "osquery", "product": "osquery", "versions": [{"status": "affected", "version": "< 5.23.1"}]}]}], "published": "2026-07-10T16:16:31.400", "references": [{"url": "https://github.com/osquery/osquery/commit/6dabe9ded33bf9c6fc0f3e37ec364a1cbbd25d68", "source": "security-advisories@github.com"}, {"url": "https://github.com/osquery/osquery/pull/8961", "source": "security-advisories@github.com"}, {"url": "https://github.com/osquery/osquery/releases/tag/5.23.1", "source": "security-advisories@github.com"}, {"url": "https://github.com/osquery/osquery/security/advisories/GHSA-fg78-9q98-62hh", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-279"}, {"lang": "en", "value": "CWE-378"}, {"lang": "en", "value": "CWE-379"}]}], "descriptions": [{"lang": "en", "value": "osquery is a SQL powered operating system instrumentation, monitoring, and analytics framework. Prior to 5.23.1, an unprivileged attacker can read the contents of an osquery file carve until the carve completes and the temporary files are deleted because in-progress carve directories are not created with private permissions. If the carve targets a directory that the attacker controls, arbitrary file reads are possible, such as sensitive local files. This issue is fixed in version 5.23.1."}], "lastModified": "2026-07-10T20:16:45.867", "sourceIdentifier": "security-advisories@github.com"}