CVE-2026-32810 - Vulnerability Analysis

Overview

Halloy IRC application on *nix and macOS prior to commit f180e41061db393acf65bc99f5c5e7397586d9cb contains an information disclosure vulnerability caused by default umask permissions on config files, letting local attackers read plaintext credentials, exploit requires local system access.

Severity & Score

Impact

Local attackers can read plaintext credentials from config files, leading to credential compromise and potential further system access.

Mitigation

Update to the version including commit f180e41061db393acf65bc99f5c5e7397586d9cb or later.

References

• https://github.com/squidowl/halloy/commit/f180e41061db393acf65bc99f5c5e7397586d9cb
• https://github.com/squidowl/halloy/security/advisories/GHSA-x5j2-fr4h-9p7g

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner