https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-05T15:35:15.518958+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2023-32303 CVE-2023-32303 — Planet's secret file is created with excessive permissions 2026-10-05T15:35:15.520511+00:00

Affected: planetlabs planet-client-python

Planet is software that provides satellite data. The secret file stores the user's Planet API authentication information. It should only be accessible by the user, but before version 2.0.1, its permissions allowed the user's group and non-group to read the file as well. This issue was patched in version 2.0.1. As a workaround, set the secret file permissions to only user read/write by hand.

 https://cve.radiocsirt.org/vuln/ghsa-j5fj-rfh6-qj85 GHSA-j5fj-rfh6-qj85 — Planet's secret file is created with excessive permissions 2026-10-05T15:35:15.520567+00:00

Affected: PyPI: planet

### Impact The secret file stores the user's Planet API authentication information. It should only be accessible by the user, but its permissions allowed the user's group and non-group to read the file as well.

### Validation Check the permissions on the secret file with `ls -l ~/.planet.json` and ensure that they read as `-rw-------`

### Patches [d71415a8](https://github.com/planetlabs/planet-client-python/commit/d71415a83119c5e89d7b80d5f940d162376ee3b7)

### Workarounds Set the secret file permissions to only user read/write by hand: ``` chmod 600 ~/.planet.json ```