projectdiscovery/nuclei · error

could not create temp secrets file

Error message

could not create temp secrets file: %w

What it means

os.CreateTemp(tempDir, "inline-secrets-*.yaml") failed (cmd/nuclei/main.go:904) while materializing the inline secrets file. The directory was created the line before, so failures here are usually EMFILE (too many open files), permission/MAC denials on the 0700 directory (e.g. owned by another user), or the directory having been removed between creation and use. The wrapped os error carries the errno.

Solutions

1. Check and raise the fd limit: `ulimit -n 4096` (or systemd LimitNOFILE)
2. Fix ownership of the temp dir so the current user can create files inside
3. Redirect TMPDIR to a private writable directory
4. Inspect audit/dmesg logs for SELinux/AppArmor denials on /tmp

Example fix

# before: EMFILE under parallel runs
nuclei -profile a.yaml & nuclei -profile b.yaml & ...

# after
ulimit -n 4096
nuclei -profile a.yaml & nuclei -profile b.yaml & ...

// pre-flight: can we create files in the temp dir?
probe, err := os.CreateTemp(tempDir, "probe-*")
if err != nil { return fmt.Errorf("temp dir not creatable: %w", err) }
_ = probe.Close()
_ = os.Remove(probe.Name())

f, err := os.CreateTemp(tempDir, "inline-secrets-*.yaml")
if err != nil {
    if errors.Is(err, syscall.EMFILE) {
        return fmt.Errorf("fd limit reached; raise ulimit -n before running parallel scans")
    }
    return fmt.Errorf("cannot create temp secrets file in %s: %w", tempDir, err)
}

When it happens

Trigger: Many concurrent nuclei processes exhausting the fd limit; /tmp/nuclei-secrets created earlier by root while running unprivileged; SELinux/AppArmor denying file creation under /tmp.

Common situations: Heavily parallel CI runners; shared servers where different users run nuclei; security-hardened hosts with MAC policies on temp paths.

Related errors

• could not create temp directory
• could not read profile file
• could not write to temp secrets file
• authentication failed
• aws s3 bucket details are missing. Please provide

AI-assisted analysis of projectdiscovery/nuclei@265b3a3dec (2026-08-15). Data as JSON: /api/errors/58896e2d66ec47b4. Report an issue: GitHub.

Appendix: source

Thrown at cmd/nuclei/main.go:904

	}

	if profile.Secrets == nil {
		return "", nil
	}

	secretsData, err := yaml.Marshal(profile.Secrets)
	if err != nil {
		return "", fmt.Errorf("could not marshal inline secrets: %w", err)
	}

	tempDir := filepath.Join(os.TempDir(), "nuclei-secrets")
	if err := os.MkdirAll(tempDir, 0700); err != nil {
		return "", fmt.Errorf("could not create temp directory: %w", err)
	}

	tempFile, err := os.CreateTemp(tempDir, "inline-secrets-*.yaml")
	if err != nil {
		return "", fmt.Errorf("could not create temp secrets file: %w", err)
	}
	defer func() {
		_ = tempFile.Close()
	}()

	if _, err := tempFile.Write(secretsData); err != nil {
		_ = tempFile.Close()
		_ = os.Remove(tempFile.Name())
		return "", fmt.Errorf("could not write to temp secrets file: %w", err)
	}

	options.SecretsFile = append(options.SecretsFile, tempFile.Name())
	return tempFile.Name(), nil
}

View on GitHub (pinned to 265b3a3dec)