PT-2026-26688 · Halloy · Halloy

Melocene · Published 2026-03-20 · Updated 2026-03-21 · CVE-2026-32810

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Halloy versions prior to commit f180e41061db393acf65bc99f5c5e7397586d9cb

Description Halloy, an IRC application written in Rust, improperly manages file permissions when creating its configuration directory and files on *nix and macOS systems. Specifically, the application uses default umask permissions, resulting in 0644 for files and 0755 for directories. This allows any local user on the system to read sensitive information, including plaintext credentials, stored in the config.toml file or referenced within password file paths.

Recommendations Update to a version with commit f180e41061db393acf65bc99f5c5e7397586d9cb or later.

Exploit

Fix

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

CVE-2026-32810

GHSA-X5J2-FR4H-9P7G

Affected Products

Halloy

References · 6

• 🔥 https://github.com/squidowl/halloy/security/advisories/GHSA-x5j2-fr4h-9p7g · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32810.json · Exploit
• https://github.com/squidowl/halloy/commit/f180e41061db393acf65bc99f5c5e7397586d9cb · Patch
• https://osv.dev/vulnerability/CVE-2026-32810 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-32810 · Security Note
• https://twitter.com/CVEnew/status/2035262132615295243 · Twitter Post