nextflow-io vulnerabilities and threats

Nextflow versions from 25.09.2-edge up to but not including 25.10.6, and from 25.11.0-edge up to but not including 26.04.3, improperly set default file permissions when writing Seqera Platform OIDC bearer tokens to seqera-auth.config. This allows local users on multi-user POSIX systems who can traverse the victim's home directory to read the token file and impersonate the victim within the token's scope. Single-user systems and headless CI runners not using interactive login are not affected. The issue is fixed in versions 25.10.6 and 26.04.3.