CVE-2026-46388: osquery File Carve Permission Flaw Allows Local File Disclosure

Technical summary

CVE-2026-46388 stems from improper file permission configuration in osquery's carve functionality. The vulnerability exists because in-progress carve directories are created without restrictive permissions (CWE-279: Improper Access Control), allowing any unprivileged user on the system to read their contents. An attacker can leverage this window of time—between carve initiation and temporary file cleanup—to read arbitrary files, especially if the carve targets a directory under attacker control. The issue involves multiple access control weaknesses: inadequate directory permissions (CWE-378) and insecure temporary file creation (CWE-379). Exploitation requires local system access and user interaction to trigger a carve operation.

Business impact

For organizations running osquery as part of their endpoint monitoring or compliance framework, this vulnerability introduces a localized information disclosure risk. Compromised credentials or insider threats could leverage this to exfiltrate sensitive configuration files, credentials, or logs that osquery is monitoring. The impact is limited to systems running vulnerable osquery versions and requires local presence, so remote attack is not possible. However, for sensitive environments—financial services, healthcare, high-security research—the ability for a local attacker to read privileged files during monitoring operations represents a meaningful data loss risk that may violate compliance requirements.

Affected systems

osquery versions prior to 5.23.1 are affected. The vulnerability requires local user access and is most relevant to multi-user systems or environments where untrusted users have shell access. Standalone single-user deployments face lower risk, but corporate endpoints where multiple accounts exist should be prioritized for patching.

Exploitability

This vulnerability requires low complexity exploitation but is constrained by prerequisites: an attacker must already have unprivileged local access to the target system, and exploitation depends on user interaction—specifically, a carve operation must be initiated (either by system administrators or automated monitoring). The CVSS score of 4.4 (Medium) reflects these practical limitations. There is no known public exploit code, and the attack window is time-bound (limited to the duration of the carve operation and before cleanup). Exploitation is not trivial and requires understanding of osquery's carve mechanics.

Remediation

Upgrade osquery to version 5.23.1 or later, which fixes the permission configuration issue. Organizations should prioritize systems that handle sensitive data or run in multi-tenant environments. After patching, verify that carve operations function normally and that no monitoring capabilities are degraded. For systems that cannot be patched immediately, restrict local user access where possible and monitor for suspicious file access patterns during carve operations.

Patch guidance

Update osquery to 5.23.1 or newer. This patch corrects the directory permission configuration used during file carve operations. Verify the patch in your vendor advisory to confirm the exact version number for your distribution. Testing in a non-production environment is recommended to ensure monitoring workflows are unaffected. No rollback concerns are anticipated, as the fix improves security without changing carve functionality.

Detection guidance

Monitor for unusual file access patterns during osquery carve operations, particularly from unprivileged users accessing /tmp or other temporary directories where carves are staged. Log file access attempts to in-progress carve directories. Audit local user accounts and disable unnecessary shell access where feasible. On systems where carve operations are frequent, correlate user activity logs with carve scheduling to identify anomalous access timing.

Why prioritize this

While the CVSS score is moderate (4.4), organizations should prioritize this patch based on environment sensitivity rather than raw score. Patch within 60 days for general enterprise deployments; accelerate to 30 days if osquery runs on systems handling highly sensitive data, credentials, or compliance-critical logs. The requirement for local access and user interaction naturally limits scope, but multi-user systems and those supporting contractors or third-party access warrant faster patching.

Risk score, explained

The CVSS 3.1 score of 4.4 (Medium severity) reflects a local attack vector, high attack complexity, and requirement for low-level privileges and user interaction. However, the High confidentiality impact acknowledges that sensitive files can be read if the attack succeeds. The score appropriately captures that this is a real but constrained risk—not a critical flaw, but one that should not be ignored, especially in regulated or multi-user environments.

Frequently asked questions