CVE-2026-46388 Details
Description
osquery is a SQL powered operating system instrumentation, monitoring, and analytics framework. Prior to 5.23.1, an unprivileged attacker can read the contents of an osquery file carve until the carve completes and the temporary files are deleted because in-progress carve directories are not created with private permissions. If the carve targets a directory that the attacker controls, arbitrary file reads are possible, such as sensitive local files. This issue is fixed in version 5.23.1.
A vulnerability in Osquery prior to version 5.23.1 allows unprivileged users to read the contents of temporary files created during the file carving process. This access persists until the carving is complete and the files are deleted. The issue arises because the directories for in-progress carvings are not set with private permissions, leaving them accessible to other users. If the carving targets a directory controlled by the attacker, this could lead to unauthorized access to sensitive files, such as those containing password information. The vulnerability has been addressed in Osquery version 5.23.1.
Users can upgrade to Osquery version 5.23.1, where this vulnerability has been fixed. Instructions for downloading the latest version are available on the Osquery GitHub Releases page.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 10, 2026CISA-ADP
Assessed Jul 10, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/osquery/osquery/commit/6dabe9ded33bf9c6fc0f3e37ec364a1cbbd25d68 | [email protected] | Source CodeVendor |
| https://github.com/osquery/osquery/pull/8961 | [email protected] | Source CodeVendor |
| https://github.com/osquery/osquery/releases/tag/5.23.1 | [email protected] | Release NotesVendor |
| https://github.com/osquery/osquery/security/advisories/GHSA-fg78-9q98-62hh | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-279 | Incorrect Execution-Assigned Permissions | [email protected] |
| CWE-378 | Creation of Temporary File With Insecure Permissions | [email protected] |
| CWE-379 | Creation of Temporary File in Directory with Insecure Permissions | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| osquery | <= 5.23.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 10, 2026 | CVE Modified | CISA-ADP |
| Jul 10, 2026 | New CVE Received | [email protected] |