CVE-2026-46388

MEDIUM4.4

osquery: Unprivileged users can temporarily read file carve contents

Published Jul 10, 2026

Modified 2 weeks ago

Details

osquery is a SQL powered operating system instrumentation, monitoring, and analytics framework. Prior to 5.23.1, an unprivileged attacker can read the contents of an osquery file carve until the carve completes and the temporary files are deleted because in-progress carve directories are not created with private permissions. If the carve targets a directory that the attacker controls, arbitrary file reads are possible, such as sensitive local files. This issue is fixed in version 5.23.1.

References

WEB

https://github.com/osquery/osquery/commit/6dabe9ded33bf9c6fc0f3e37ec364a1cbbd25d68

WEB

https://github.com/osquery/osquery/pull/8961

WEB

https://github.com/osquery/osquery/releases/tag/5.23.1

WEB

https://github.com/osquery/osquery/security/advisories/GHSA-fg78-9q98-62hh

ADVISORY

https://www.cve.org/CVERecord?id=CVE-2026-46388

CVSS Analysis