CVE-2026-61828: CWE-276: Incorrect Default Permissions in NixOS nixpkgs
A vulnerability in the NixOS nixpkgs MySQL module allows local unprivileged users to log in as the root MySQL user without a password due to incorrect default permissions during database initialization. This issue affects configurations using the mysql or percona-server services. The vulnerability is fixed in the 25.11 and 26.05 NixOS channels.
AI Analysis
Technical Summary
CVE-2026-61828 describes an incorrect default permissions vulnerability (CWE-276) in the NixOS nixpkgs MySQL module. Prior to fixes in the 25.11 and 26.05 channels, the MySQL database initialization allowed local users, including unprivileged web or CGI processes on the same host, to authenticate as the MySQL root user without a password. This occurs when using the mysql or percona-server services. The vulnerability is resolved in the specified fixed channels.
Potential Impact
Local unprivileged users on the affected system can gain unauthorized root access to the MySQL database without authentication. This can lead to full compromise of the database, data exposure, and potential further system compromise depending on the database's role and privileges.
Mitigation Recommendations
The issue is fixed in the NixOS 25.11 and 26.05 channels. Users should upgrade to these or later versions to remediate the vulnerability. No other mitigation guidance is provided or required based on the available data.
CVE-2026-61828: CWE-276: Incorrect Default Permissions in NixOS nixpkgs
Description
A vulnerability in the NixOS nixpkgs MySQL module allows local unprivileged users to log in as the root MySQL user without a password due to incorrect default permissions during database initialization. This issue affects configurations using the mysql or percona-server services. The vulnerability is fixed in the 25.11 and 26.05 NixOS channels.
CVSS v4.0
Score 8.5high
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-61828 describes an incorrect default permissions vulnerability (CWE-276) in the NixOS nixpkgs MySQL module. Prior to fixes in the 25.11 and 26.05 channels, the MySQL database initialization allowed local users, including unprivileged web or CGI processes on the same host, to authenticate as the MySQL root user without a password. This occurs when using the mysql or percona-server services. The vulnerability is resolved in the specified fixed channels.
Potential Impact
Local unprivileged users on the affected system can gain unauthorized root access to the MySQL database without authentication. This can lead to full compromise of the database, data exposure, and potential further system compromise depending on the database's role and privileges.
Mitigation Recommendations
The issue is fixed in the NixOS 25.11 and 26.05 channels. Users should upgrade to these or later versions to remediate the vulnerability. No other mitigation guidance is provided or required based on the available data.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-07-10T20:17:57.993Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a57a83f68715ace43f80c00
Added to database: 07/15/2026, 15:33:19 UTC
Last enriched: 07/15/2026, 15:47:45 UTC
Last updated: 07/15/2026, 15:47:45 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.