PT-2026-26688 · Halloy · Halloy

Melocene · Publicado 2026-03-20 · Atualizado 2026-03-21 · CVE-2026-32810

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Média

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Halloy versions prior to commit f180e41061db393acf65bc99f5c5e7397586d9cb

Description Halloy, an IRC application written in Rust, improperly manages file permissions when creating its configuration directory and files on *nix and macOS systems. Specifically, the application uses default umask permissions, resulting in 0644 for files and 0755 for directories. This allows any local user on the system to read sensitive information, including plaintext credentials, stored in the config.toml file or referenced within password file paths.

Recommendations Update to a version with commit f180e41061db393acf65bc99f5c5e7397586d9cb or later.

Exploit

Correção

Incorrect Permission

Enumeração de Fraquezas

CWE-732

Identificadores relacionados

CVE-2026-32810

GHSA-X5J2-FR4H-9P7G

Produtos afetados

Halloy

Referências · 6

• 🔥 https://github.com/squidowl/halloy/security/advisories/GHSA-x5j2-fr4h-9p7g · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32810.json · Exploit
• https://github.com/squidowl/halloy/commit/f180e41061db393acf65bc99f5c5e7397586d9cb · Correção
• https://twitter.com/CVEnew/status/2035262132615295243 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-32810 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-32810 · Nota de Segurança