What’s Vulnerable › Vulnerabilities

CVE-2026-45246: Summarize < 0.15.1 Insecure File Permissions Information Disclosure

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.1% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-05-18 · updated 2026-10-14
• Weakness: CWE-732

Description

Summarize prior to 0.15.1 contains an insecure file permission vulnerability in the refresh-free configuration rewrite path that allows local users to read sensitive credentials by exploiting default filesystem permissions. When the refresh-free path rewrites the configuration file, it creates the replacement with default process umask permissions instead of preserving the original file permissions, exposing the config file containing API keys and provider credentials to other local users on shared Unix-like systems.

Affected products

• steipete summarize: before 0.15.1 — fixed in 0.15.1

How to fix

Upgrade to a fixed version: steipete summarize 0.15.1. Check the vendor advisory for mitigations.

References

• https://github.com/steipete/summarize/commit/9e990193650a23dab73f37d5e1964d574a44098b
• https://github.com/steipete/summarize/pull/217
• https://github.com/steipete/summarize/releases/tag/v0.15.2
• https://www.vulncheck.com/advisories/summarize-insecure-file-permissions-information-disclosure

Get alerted when CVE-2026-45246 or the next vulnerability affects your stack