Unrated severityNVD Advisory· Published Mar 20, 2026· Updated Mar 23, 2026
Halloy has insecure file permissions on credential files
CVE-2026-32810
Description
Halloy is an IRC application written in Rust. In versions on \*nix and macOS prior to commit f180e41061db393acf65bc99f5c5e7397586d9cb, halloy creates its config directory and files using default umask permissions, which typically results in 0644 on files and 0755 on directories. This allows any local user on the system to read plaintext credentials stored in config.toml or referenced password_file paths. Commit f180e41061db393acf65bc99f5c5e7397586d9cb patches the issue.
Affected products
1Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
2- github.com/squidowl/halloy/commit/f180e41061db393acf65bc99f5c5e7397586d9cbmitrex_refsource_MISC
- github.com/squidowl/halloy/security/advisories/GHSA-x5j2-fr4h-9p7gmitrex_refsource_CONFIRM
News mentions
0No linked articles in our index yet.