LiveActive security incident?Get immediate response
CVE Record

CVE-2026-45222: Summarize Insecure Daemon Configuration File Permissions

Summarize versions through 0.14.1, fixed in commit 0cfb0fb, creates the daemon configuration directory and file with default filesystem permissions that may be world-readable on Unix-like systems, allowing local attackers to read bearer tokens and API credentials stored in ~/.summarize/daemon.json. A local attacker can exploit these permissive permissions to read the daemon bearer token and persisted provider credentials, enabling unauthorized access to the daemon or recovery of sensitive API keys.

MediumCVSS 6.9Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

Summarize stored daemon bearer tokens and provider API credentials in a Unix configuration file that could be readable by other local users. A user with local access to the same machine may recover those secrets and use them to access the daemon or associated providers. Available sources do not describe a remote internet-facing attack.

Executive priority

Treat this as a moderate-priority secrets exposure issue. Prioritize shared machines, CI runners, production hosts, and developer workstations containing valuable API credentials. Remediate promptly, but available sources do not support emergency internet-wide response.

Technical view

CVE-2026-45222 is a CWE-732 permissions issue in Summarize through 0.14.1. The daemon configuration directory and ~/.summarize/daemon.json were created with default filesystem permissions that may be world-readable on Unix-like systems. The stated fix is commit 0cfb0fb99777a87a7b02082b5e4bd449f8dd6175.

Likely exposure

Exposure is most relevant on Unix-like, shared, developer, CI, or server systems where Summarize is installed and local users are not fully trusted. Single-user systems have lower practical risk, but secrets may still need rotation if permissions were permissive.

Exploitation context

The CVSS vector requires local access and low privileges, with no user interaction. The source bundle says KEV is false and provides no cited evidence of active exploitation. Impact centers on confidentiality of daemon bearer tokens and persisted provider credentials.

Researcher notes

Key evidence is consistent across the CVE description, patch reference, pull request, and VulnCheck advisory. The bundle does not name a fixed package version beyond the commit, so validation should focus on code provenance, file permissions, and credential exposure.

Mitigation direction

  • Upgrade to a release containing commit 0cfb0fb, if available.
  • If no release exists, follow vendor guidance for applying the patch.
  • Restrict ~/.summarize and daemon.json to the owning user only.
  • Rotate daemon bearer tokens and provider API credentials that may have been exposed.
  • Review shared hosts for untrusted local users with filesystem access.

Validation and detection

  • Inventory Summarize installations and identify versions through 0.14.1.
  • Confirm Unix-like hosts create the daemon directory and file with private owner-only access.
  • Check whether daemon.json contains bearer tokens or provider credentials.
  • Verify deployed code includes commit 0cfb0fb99777a87a7b02082b5e4bd449f8dd6175.
  • Document any credential rotation completed after remediation.
Prepared
Confidence
medium
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · medium confidence lookup

CWE-732: Authorization and privilege behavior lookup

Authorization weaknesses can support privilege escalation and valid-account review, depending on exploit path. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
description · low confidence lookup

Credential and access behavior lookup

The CVE wording references authentication or credential exposure, so valid-account and credential-access review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2026-45222 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Medium
CVSS
6.9 (4.0)
Known Exploited
No
Published

Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

2CVSS vectors
3Timeline events
1ADP providers
4Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: pocAutomatable: noTechnical Impact: partial

CVSS vector scores

2 official scores

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
6.9CVSS 4.0MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N——VulnCheck
6.1CVSS 3.1MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N1.84.2VulnCheck

Vulnerability scoring details

Base CVSS 4.0 score

6.9Medium
CVSS 4.0 vector shape for CVE-2026-45222Attack VectorAttack ComplexityAttack RequirementsPrivileges RequiredUser InteractionVS ConfidentialityVS IntegrityVS AvailabilitySS ConfidentialitySS IntegritySS Availability

Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Attack Requirements
NonePresent
Privileges Required
NoneLowHigh
User Interaction
NonePassiveActive
VS Confidentiality
HighLowNone
VS Integrity
HighLowNone
VS Availability
HighLowNone
SS Confidentiality
HighLowNone
SS Integrity
HighLowNone
SS Availability
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
other:ssvc

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
steipetesummarize0, 0cfb0fb99777a87a7b02082b5e4bd449f8dd6175affected
Weakness

CWE details

CWE-732

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.