CVE-2026-32810: 
NixOS vulnerability analysis and mitigation

CVE-2026-32810 is an insecure file permissions vulnerability in Halloy, an IRC client written in Rust, that allows any local user to read plaintext IRC credentials stored in configuration files. On *nix and macOS systems, Halloy versions up to and including 2026.4 create their config directory and files using default umask permissions, resulting in mode 0644 on files and 0755 on directories — making them world-readable. The vulnerability was published on March 20, 2026, and carries a CVSS v3.1 base score of 5.5 (Medium) and a CVSS v4.0 base score of 4.8 (Medium) (GitHub Advisory).

The root cause is CWE-732 (Incorrect Permission Assignment for Critical Resource): Halloy does not set explicit permissions when creating its config directory or writing the initial config.toml file, relying instead on the system's default umask (typically 0022 on most Linux distributions). The affected code paths are in data/src/config.rs, where create_dir_all is called without a mode argument for the config, sounds, and themes directories, and std::fs::write is used without restricting file permissions for the initial config. Credentials stored in config.toml — including password, nick_password, and sasl.plain.password fields — as well as any files referenced by password_file, nick_password_file, or sasl.plain.password_file are exposed. Users relying on password_command are not affected, as those passwords are passed via stdout and never written to disk (GitHub Advisory, Patch Commit).

Successful exploitation results in disclosure of plaintext IRC credentials (server passwords, NickServ passwords, and SASL passwords) to any local user on a shared system, with no elevated privileges required. There is no integrity or availability impact, but the confidentiality breach can enable credential stuffing attacks against other services if users reuse passwords. The risk is most significant on multi-user systems such as shared Linux servers or university/enterprise environments (GitHub Advisory).

A proof-of-concept exploit sequence is publicly documented in the GitHub Security Advisory, demonstrating that a second local user can simply run cat /home/user_a/.config/halloy/config.toml to read another user's credentials — no special tools or privileges required. There is no evidence of active in-the-wild exploitation at this time, and the vulnerability has not been added to the CISA KEV catalog. The EPSS score is approximately 0.011% (very low probability of exploitation in the near term) (GitHub Advisory).

1. Identify target: Confirm the target system is a shared *nix or macOS host with multiple user accounts and that the victim (User A) has installed and run Halloy version ≤ 2026.4.
2. Locate config file: As an unprivileged local user (User B), determine the victim's home directory (e.g., via ls /home/ or getent passwd).
3. Read credentials: Execute cat /home/user_a/.config/halloy/config.toml to read the world-readable config file, which may contain password, nick_password, or sasl.plain.password fields in plaintext.
4. Check password files: If the config references external password files (e.g., password_file = "/home/user_a/.config/halloy/irc_pass"), read those files directly as they are also created with permissive permissions.
5. Use credentials: Leverage the obtained IRC credentials to authenticate to IRC servers as the victim, or attempt credential stuffing against other services if the user reuses passwords (GitHub Advisory).

• File System: Presence of ~/.config/halloy/config.toml with permissions 0644 (world-readable) or ~/.config/halloy/ directory with permissions 0755 on *nix/macOS systems running Halloy ≤ 2026.4.
• File System: Any password files referenced by password_file, nick_password_file, or sasl.plain.password_file in config.toml that are readable by non-owner users.
• Logs: Shell history or audit logs (e.g., auditd) showing cat, less, or cp commands accessing another user's ~/.config/halloy/ directory by a different local user account.
• Process: Unexpected IRC authentication attempts from the victim's credentials originating from a different user account or IP address than the legitimate user (GitHub Advisory).

The fix is applied in commit f180e41061db393acf65bc99f5c5e7397586d9cb, which introduces create_owned_dir (mode 0700) and create_owned_file (mode 0600) helper functions for Unix systems, replacing the insecure default-umask calls. Users should update Halloy to a version that includes this commit (post-2026.4). As an immediate workaround, manually restrict permissions with chmod 700 ~/.config/halloy/ and chmod 600 ~/.config/halloy/config.toml and any referenced password files. Additionally, rotate any IRC credentials that may have been exposed on shared systems (GitHub Advisory, Patch Commit).

The vulnerability was reported by researcher melocene and remediated by Halloy maintainer casperstorm. A NixOS packaging issue and pull request were opened to update the Halloy package in nixpkgs following the disclosure, indicating community awareness and prompt downstream response (GitHub Advisory).