CVE-2026-35367: CWE-732: Incorrect Permission Assignment for Critical Resource in Uutils coreutils
The nohup utility in uutils coreutils creates its default output file, nohup.out, without specifying explicit restricted permissions. This causes the file to inherit umask-based permissions, typically resulting in a world-readable file (0644). In multi-user environments, this allows any user on the system to read the captured stdout/stderr output of a command, potentially exposing sensitive information. This behavior diverges from GNU coreutils, which creates nohup.out with owner-only (0600) permissions.
AI Analysis
Technical Summary
CVE-2026-35367 describes a permissions misconfiguration in the nohup utility of uutils coreutils. The utility creates the nohup.out file without explicitly restricting permissions, causing it to inherit the system's umask and often become world-readable (0644). This contrasts with the behavior of GNU coreutils, which creates nohup.out with more restrictive owner-only permissions (0600). As a result, in multi-user systems, other users may read the output of nohup-invoked commands, potentially exposing sensitive data. The vulnerability is categorized under CWE-732 and has a low severity rating based on CVSS 3.1 metrics.
Potential Impact
The impact is limited to information disclosure where other users on the same system can read the nohup.out file created by uutils coreutils' nohup utility. There is no impact on integrity or availability. The exposure is dependent on the system's umask and multi-user environment. No known exploits are reported in the wild.
Mitigation Recommendations
Patch status is not yet confirmed — no official fix or remediation level has been provided by the vendor. Users should consider manually restricting permissions on nohup.out files after creation or use alternative nohup implementations that enforce stricter file permissions. Monitor vendor advisories for updates regarding an official fix.
CVE-2026-35367: CWE-732: Incorrect Permission Assignment for Critical Resource in Uutils coreutils
Description
The nohup utility in uutils coreutils creates its default output file, nohup.out, without specifying explicit restricted permissions. This causes the file to inherit umask-based permissions, typically resulting in a world-readable file (0644). In multi-user environments, this allows any user on the system to read the captured stdout/stderr output of a command, potentially exposing sensitive information. This behavior diverges from GNU coreutils, which creates nohup.out with owner-only (0600) permissions.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-35367 describes a permissions misconfiguration in the nohup utility of uutils coreutils. The utility creates the nohup.out file without explicitly restricting permissions, causing it to inherit the system's umask and often become world-readable (0644). This contrasts with the behavior of GNU coreutils, which creates nohup.out with more restrictive owner-only permissions (0600). As a result, in multi-user systems, other users may read the output of nohup-invoked commands, potentially exposing sensitive data. The vulnerability is categorized under CWE-732 and has a low severity rating based on CVSS 3.1 metrics.
Potential Impact
The impact is limited to information disclosure where other users on the same system can read the nohup.out file created by uutils coreutils' nohup utility. There is no impact on integrity or availability. The exposure is dependent on the system's umask and multi-user environment. No known exploits are reported in the wild.
Mitigation Recommendations
Patch status is not yet confirmed — no official fix or remediation level has been provided by the vendor. Users should consider manually restricting permissions on nohup.out files after creation or use alternative nohup implementations that enforce stricter file permissions. Monitor vendor advisories for updates regarding an official fix.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- canonical
- Date Reserved
- 2026-04-02T12:58:56.088Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 69e8f7d319fe3cd2cdd00d10
Added to database: 4/22/2026, 4:31:15 PM
Last enriched: 4/22/2026, 4:48:30 PM
Last updated: 4/23/2026, 12:59:20 AM
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.