CVE-2026-46388: 
OSQuery vulnerability analysis and mitigation

CVE-2026-46388 is an insecure temporary file permissions vulnerability in osquery, a SQL-powered operating system instrumentation and analytics framework. Prior to version 5.23.1, in-progress file carve directories are created without private (owner-only) permissions, allowing an unprivileged local attacker to read the contents of an osquery file carve while it is in progress. If the carve targets a directory controlled by the attacker, arbitrary file reads — including sensitive files such as /etc/shadow — are possible. The vulnerability affects all osquery versions up to and including 5.23.0, and was fixed in 5.23.1 released on June 24, 2026. It carries a CVSS v3.1 base score of 4.4 (Medium) (GitHub Advisory, osquery Release).

The root cause is classified under CWE-279 (Incorrect Execution-Assigned Permissions), CWE-378 (Creation of Temporary File With Insecure Permissions), and CWE-379 (Creation of Temporary File in Directory with Insecure Permissions). When osquery performs a file carve, it creates a temporary working directory under the system temp path using the standard fs::create_directory() call, which does not enforce owner-only access and is subject to the process umask — leaving the directory potentially readable by other local users during the carve operation. An attacker with low-privilege local access who can influence or control the carve target directory can read the carve contents before the temporary files are deleted. The fix introduced a new cross-platform API, platformCreatePrivateDir(), which creates the carve directory atomically with mode 0700 on POSIX (via mkdir(..., S_IRWXU)) and with an explicit owner-only DACL on Windows, eliminating the race window (GitHub PR #8961, GitHub Commit).

Successful exploitation allows an unprivileged local attacker to read the contents of files being carved by osquery, including potentially sensitive system files such as /etc/shadow (password hashes), private keys, or configuration files containing credentials. The impact is limited to confidentiality — there is no integrity or availability impact. Exploitation is constrained to the window during which the carve is in progress and temporary files exist, and requires the attacker to have local access to the system running osquery (GitHub Advisory).

No public exploit code or in-the-wild exploitation has been reported for this vulnerability. The NVD SSVC assessment classifies exploitation as "none" and the vulnerability as not automatable. The EPSS score is approximately 0.094%, reflecting a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access, low privileges, user interaction (a carve must be triggered), and high attack complexity, significantly limiting the practical attack surface (GitHub Advisory).

1. Gain local access: Obtain a low-privileged local account on a system running a vulnerable version of osquery (≤ 5.23.0) with file carving enabled.
2. Monitor for carve activity: Watch for the creation of temporary directories matching the osquery carve path prefix (e.g., /tmp/osquery_carve_<GUID>/) using tools like inotifywait or by polling the temp directory.
3. Control or influence carve target: If possible, arrange for osquery to carve a directory or file path that the attacker controls or can predict, to maximize the window of opportunity.
4. Read carve contents: As soon as the carve directory is created (before the carve completes and files are deleted), read the contents of the temporary files within the directory — these may include sensitive files such as /etc/shadow or private keys that osquery was tasked to carve.
5. Exfiltrate data: Copy or transmit the read file contents before osquery deletes the temporary directory upon carve completion (GitHub Advisory, GitHub PR #8961).

• File System: Unexpected access to osquery temporary carve directories (e.g., /tmp/osquery_carve_*/) by processes or users other than the osquery service account; audit logs showing reads of files within these directories by non-osquery users.
• Logs: OS-level audit logs (e.g., Linux auditd with file access rules on /tmp/) showing unauthorized open() or read() syscalls on osquery carve temp directories during active carve operations.
• Process: Processes such as cat, cp, python, or shell scripts accessing /tmp/osquery_carve_* paths while osquery is running a carve job.

Upgrade osquery to version 5.23.1 or later, which fixes the insecure permissions on temporary carve directories (osquery Release). As a workaround for systems that cannot be immediately upgraded, disable file carving by setting the --disable_carver=true flag; note that file carving is disabled by default and must be explicitly enabled, so environments that have not enabled it are not affected. Avoid executing file carves on vulnerable versions until the upgrade is applied (GitHub Advisory).

The vulnerability was reported by security researcher raj3shp and the advisory was published by osquery maintainer zwass on July 1, 2026. The fix was developed and merged by zwass on June 24, 2026, as part of the 5.23.1 security and bug fix release. The NixOS/nixpkgs project tracked the issue and opened a corresponding update PR (GitHub Advisory, osquery Release). No significant broader media coverage or social media discussion has been identified.