CVE-2026-32810

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-32810", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-16T17:35:36.696Z", "datePublished": "2026-03-20T22:40:49.237Z", "dateUpdated": "2026-03-23T21:41:38.612Z"}, "containers": {"cna": {"title": "Halloy has insecure file permissions on credential files", "problemTypes": [{"descriptions": [{"cweId": "CWE-732", "lang": "en", "description": "CWE-732: Incorrect Permission Assignment for Critical Resource", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 4.8, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/squidowl/halloy/security/advisories/GHSA-x5j2-fr4h-9p7g", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/squidowl/halloy/security/advisories/GHSA-x5j2-fr4h-9p7g"}, {"name": "https://github.com/squidowl/halloy/commit/f180e41061db393acf65bc99f5c5e7397586d9cb", "tags": ["x_refsource_MISC"], "url": "https://github.com/squidowl/halloy/commit/f180e41061db393acf65bc99f5c5e7397586d9cb"}], "affected": [{"vendor": "squidowl", "product": "halloy", "versions": [{"version": "<= 2026.4", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-20T22:40:49.237Z"}, "descriptions": [{"lang": "en", "value": "Halloy is an IRC application written in Rust. In versions on \\*nix and macOS prior to commit f180e41061db393acf65bc99f5c5e7397586d9cb, halloy creates its config directory and files using default umask permissions, which typically results in `0644` on files and `0755` on directories. This allows any local user on the system to read plaintext credentials stored in `config.toml` or referenced `password_file` paths. Commit f180e41061db393acf65bc99f5c5e7397586d9cb patches the issue."}], "source": {"advisory": "GHSA-x5j2-fr4h-9p7g", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/squidowl/halloy/security/advisories/GHSA-x5j2-fr4h-9p7g", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-23T21:00:54.544825Z", "id": "CVE-2026-32810", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-23T21:41:38.612Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-32810", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-23T21:00:54.544825Z"}}}], "references": [{"url": "https://github.com/squidowl/halloy/security/advisories/GHSA-x5j2-fr4h-9p7g", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-23T21:01:06.941Z"}}], "cna": {"title": "Halloy has insecure file permissions on credential files", "source": {"advisory": "GHSA-x5j2-fr4h-9p7g", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 4.8, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "LOW"}}], "affected": [{"vendor": "squidowl", "product": "halloy", "versions": [{"status": "affected", "version": "<= 2026.4"}]}], "references": [{"url": "https://github.com/squidowl/halloy/security/advisories/GHSA-x5j2-fr4h-9p7g", "name": "https://github.com/squidowl/halloy/security/advisories/GHSA-x5j2-fr4h-9p7g", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/squidowl/halloy/commit/f180e41061db393acf65bc99f5c5e7397586d9cb", "name": "https://github.com/squidowl/halloy/commit/f180e41061db393acf65bc99f5c5e7397586d9cb", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Halloy is an IRC application written in Rust. In versions on \\*nix and macOS prior to commit f180e41061db393acf65bc99f5c5e7397586d9cb, halloy creates its config directory and files using default umask permissions, which typically results in `0644` on files and `0755` on directories. This allows any local user on the system to read plaintext credentials stored in `config.toml` or referenced `password_file` paths. Commit f180e41061db393acf65bc99f5c5e7397586d9cb patches the issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-732", "description": "CWE-732: Incorrect Permission Assignment for Critical Resource"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-20T22:40:49.237Z"}}}, "cveMetadata": {"cveId": "CVE-2026-32810", "state": "PUBLISHED", "dateUpdated": "2026-03-23T21:41:38.612Z", "dateReserved": "2026-03-16T17:35:36.696Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-20T22:40:49.237Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "halloy", "vendor": "squidowl", "versions": [{"status": "affected", "version": "<= 2026.4"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:halloy:halloy:*:*:*:*:*:*:*:*", "matchCriteriaId": "EAB64661-0590-4ABE-B7BC-1D17D0681AC3", "versionEndIncluding": "2026.4", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Halloy is an IRC application written in Rust. In versions on \\*nix and macOS prior to commit f180e41061db393acf65bc99f5c5e7397586d9cb, halloy creates its config directory and files using default umask permissions, which typically results in `0644` on files and `0755` on directories. This allows any local user on the system to read plaintext credentials stored in `config.toml` or referenced `password_file` paths. Commit f180e41061db393acf65bc99f5c5e7397586d9cb patches the issue."}, {"lang": "es", "value": "Halloy es una aplicaci\u00f3n de IRC escrita en Rust. En versiones en *nix y macOS anteriores al commit f180e41061db393acf65bc99f5c5e7397586d9cb, halloy crea su directorio de configuraci\u00f3n y archivos usando los permisos umask predeterminados, lo que normalmente resulta en '0644' en archivos y '0755' en directorios. Esto permite a cualquier usuario local en el sistema leer credenciales en texto plano almacenadas en 'config.toml' o rutas de 'password_file' referenciadas. El commit f180e41061db393acf65bc99f5c5e7397586d9cb corrige el problema."}], "id": "CVE-2026-32810", "lastModified": "2026-06-17T10:36:22.983", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-32810", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-23T21:00:54.544825Z", "version": "2.0.3"}}]}, "published": "2026-03-20T23:16:44.863", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/squidowl/halloy/commit/f180e41061db393acf65bc99f5c5e7397586d9cb"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/squidowl/halloy/security/advisories/GHSA-x5j2-fr4h-9p7g"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/squidowl/halloy/security/advisories/GHSA-x5j2-fr4h-9p7g"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-732"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,2026.4]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "halloy", "source": "cna", "vendor": "squidowl"}, "product": "halloy", "vendor": "squidowl"}], "analysis": {"en": {"generated_at": "2026-03-23T20:26:36.249488+00:00", "value": {"mitigation_remediation": ["Upgrade Halloy to version containing commit f180e41061db393acf65bc99f5c5e7397586d9cb or later.", "If an immediate upgrade is not possible, change the permissions of the config directory and its files to 0700 and 0600 respectively, and place any credential files in a secure location.", "Remove or delete any plaintext credential files that were previously accessible.", "Verify the operating system\u2019s umask and ensure it does not grant group or world read permissions to sensitive files if Halloy is reinstalled."], "summary": {"action": "Apply patch", "impact": "Local read of plaintext credentials"}, "threat_synthesis": {"affected_systems": "The affected product is Squidowl Halloy. All Halloy releases on Unix-like systems and macOS that run before the patch commit f180e41061db393acf65bc99f5c5e7397586d9cb are impacted. No specific version numbers are listed in the CNA data; the fix is applied in the mentioned commit or any later releases that include the change.", "description_and_impact": "Halloy is an IRC client that stores user credentials in plain text within its configuration files. In versions of Halloy running on Linux and macOS before the commit f180e41061db393acf65bc99f5c5e7397586d9cb, the application creates its config directory and files using the system's default umask. This results in 0644 permissions on files and 0755 on directories, allowing any local user to read the contents of config.toml or any password_file referenced therein. The vulnerability therefore represents a confidentiality breach for local users, exposing potentially sensitive authentication data to the entire local user base.", "risk_and_exploitability": "The CVSS score of 4.8 categorizes the issue as moderate severity, reflecting the local nature of the attack vector. The EPSS score is below 1%, indicating that exploitation is unlikely to occur at scale and there are no publicly known exploits at this time. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires a user to have local access; an attacker could read the default config files, revealing stored credentials. Because the flaw does not impact remote users, the overall risk to environments with strict local user isolation is reduced, but any shared or privileged system remains vulnerable until patched."}}}}, "created": "2026-03-23T09:52:20.569299+00:00", "updated": "2026-03-25T14:34:12.831107+00:00", "vendors": ["squidowl", "squidowl$PRODUCT$halloy"]}