CVE-2026-45246 — The Refresh-Free Configuration Rewrite Path That Vulnerability

title: CVE-2026-45246 - Insecure File Permissions on Configuration Rewrite
id: scw-2026-05-18-ai-1
status: experimental
level: medium
description: |
  Detects the creation or modification of a configuration file with insecure default permissions, indicative of CVE-2026-45246. The vulnerability allows local users to read sensitive credentials by exploiting default filesystem permissions when the refresh-free path rewrites the configuration file, creating the replacement with default process umask permissions instead of preserving original file permissions.
author: SCW Feed Engine (AI-generated)
date: 2026-05-18
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-45246/
tags:
  - attack.privilege_escalation
  - attack.t1068
logsource:
    category: file_event
detection:
  selection:
      TargetFilename|contains:
          - '/etc/some_app/config.yaml'
      EventType:
          - 'file_permission_change'
  condition: selection
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse