The command line arguments of every process in the system is considered "public". Not just the
w command, but
top and many other commands access that information as a matter of course. Indeed no special privileges are required to get that information. On Linux, you can read the command line of another process, even a process belonging to another user, by reading
This is not a flaw or unsafe behaviour on the part of
cat). Rather, the onus is on the side of not passing sensitive information on command lines on multi-user systems, ever.
Most utilities that have the ability to accept passwords on the command line document that it's not recommended to do it. For example, from
Specifying a password on the command line should be considered insecure. See Section 188.8.131.52, "End-User Guidelines for Password Security". You can use an option file to avoid giving the password on the command line.
By the way, passing passwords or sensitive data in environment variables is less blatantly unsafe, but is also actually unsafe on most systems.