CVE-2025-10937

Vulnerability

CVE-2025-10937 in Oxford Nanopore Technologies' MinKNOW software (versions at or prior to 24.11) stems from an insecure temporary file creation during startup. The software generates a local authentication token in a temporary file located in a system directory accessible to all users, before copying it to its final secure location [1]. This violates the principle of least privilege by exposing credentials in a world-readable path [2].

Exploitation requires local access to the host machine. An unauthorized user or process can place a file lock on the temporary token file using the flock system call. This prevents MinKNOW from completing the token generation process, resulting in no valid local token being created [1]. The attack does not require elevated privileges, only the ability to execute code or scripts on the system.

The impact is a denial-of-service (DoS) condition that blocks the software from executing commands on the sequencer, effectively halting all sequencing operations [1]. This can disrupt critical research or diagnostic workflows that depend on continuous data acquisition.

Oxford Nanopore Technologies has addressed this vulnerability in MinKNOW version 24.11 and later [1]. Users are advised to update to the latest version available from the vendor's software portal [4]. No workaround is documented; upgrading is the recommended mitigation.