CVE-2026-35367: uutils coreutils nohup Information Disclosure via Insecure Default Output Permissions
The nohup utility in uutils coreutils creates its default output file, nohup.out, without specifying explicit restricted permissions. This causes the file to inherit umask-based permissions, typically resulting in a world-readable file (0644). In multi-user environments, this allows any user on the system to read the captured stdout/stderr output of a command, potentially exposing sensitive information. This behavior diverges from GNU coreutils, which creates nohup.out with owner-only (0600) permissions.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-35367?
CVE-2026-35367 is classified as a medium severity vulnerability due to its potential for information disclosure via insecure file permissions.
How do I fix CVE-2026-35367?
To fix CVE-2026-35367, ensure that the nohup utility is configured to create output files with explicit restricted permissions.
What type of vulnerability is CVE-2026-35367?
CVE-2026-35367 is an information disclosure vulnerability caused by insecure default output permissions in the nohup utility.
Which software is affected by CVE-2026-35367?
CVE-2026-35367 affects the uutils coreutils package, specifically the nohup utility within it.
What are the implications of CVE-2026-35367?
The implications of CVE-2026-35367 include potential unauthorized access to sensitive information if the default nohup.out file is accessible to unintended users.