Nix versions before 2.35.3, when run unsandboxed on macOS or FreeBSD, have an incorrect authorization vulnerability that allows build users to make unauthorized connections from daemon clients. This issue is tracked as CVE-2026-110453 and is classified under CWE-863 (Incorrect Authorization). The vulnerability has a medium severity with a CVSS score of 4.3.
CVE-2026-110452 is a medium severity vulnerability in NixOS Nix affecting multiple versions before 2.35.3. The multi-user installer incorrectly assigns ownership of store contents to the invoking user instead of root, potentially leading to improper access control.
CVE-2026-110451 is a medium severity vulnerability in NixOS Nix affecting multiple versions before 2.35.3. It involves an incorrect authorization issue (CWE-863) that allows a Seatbelt sandbox escape on macOS when an unconfined build is used due to mishandling of a size threshold.
NixOS Nix versions before 2.35.3 contain a vulnerability that allows privilege escalation during a repair operation. This occurs because the repair process may destroy and then replace a store path before verifying its content, leading to incorrect behavior order. The issue affects multiple version ranges prior to 2.35.3.
CVE-2026-110449 is an integer overflow vulnerability in NixOS Nix affecting multiple versions prior to 2.35.3. The flaw occurs due to mishandling of list allocation when evaluating untrusted expressions, leading to an out-of-bounds write. This vulnerability can cause integrity impact and limited availability impact but does not affect confidentiality.
CVE-2026-64846 is a vulnerability in the Nix package manager prior to version 2.35.0. It involves a time-of-check/time-of-use (TOCTOU) race condition related to symbolic link handling during the LocalStore restore path when using the recursive-nix experimental feature. This race condition can allow the Nix process or nix-daemon to create or truncate an empty file outside the build sandbox with the daemon user's permissions. The vulnerability does not allow arbitrary content writes and requires winning the race. The issue is fixed in version 2.35.0.
Nixpkgs is a collection of software packages that can be installed with the Nix package manager. Prior to the 25.11 and 26.05 channel fixes, the NixOS module for MySQL services.mysql initializes the MySQL database in a way that allows local users, such as unprivileged web or CGI processes on the same host, to log in as the root user without a password when the service is used with mysql or percona-server. This issue is fixed in the 25.11 and 26.05.
CVE-2026-44029 is an absolute path traversal vulnerability in NixOS Nix versions prior to 2.34.7. It allows writing to arbitrary files via directory traversal when using the commands "nix-prefetch-url --unpack" or "nix store prefetch-file --unpack. " The issue affects multiple versions starting from 2.24.7 up to 2.34.0. The vulnerability has a medium severity with a CVSS score of 5.
An issue was discovered in Nix before 2.34.7 and Lix before 2.95.2. Unbounded recursion in the NAR (Nix Archive) parser could lead to a stack-to-heap overflow when the parser is run on a coroutine stack. The stack is allocated without a guard page, which means that a stack overflow could overwrite memory on the heap and could allow arbitrary code execution as the Nix daemon (run as root in multi-user installations) if ASLR hardening is bypassed. This can be exploited by all users able to connect to the daemon (e.g., in Nix, this is configurable via the allowed-users setting, defaulting to all users). The fixed versions are 2.34.7, 2.33.6, 2.32.8, 2.31.5, 2.30.5, 2.29.4, and 2.28.7 for Nix (introduced in 2.24.4); and 2.95.2, 2.94.2, and 2.93.4 for Lix (introduced in 2.93.0).
CVE-2026-39860 is a critical vulnerability in the Nix package manager affecting Linux sandboxed builds. It arises from a flaw in the fix for a previous vulnerability (CVE-2024-27297) that allows arbitrary file overwrites by following symbolic links during fixed-output derivation output registration. This can be exploited by users who can submit builds to the Nix daemon, potentially leading to root privilege escalation by overwriting sensitive files. The issue does not affect sandboxed macOS builds. Multiple versions of Nix prior to specific fixed releases are vulnerable. The vulnerability has a CVSS score of 9. A fix is available in Nix versions 2.28.6, 2.29.
CVE-2026-25740 is a medium-severity vulnerability in NixOS nixpkgs versions 25.05 and earlier, involving the captive-browser feature. This feature runs a dedicated Chrome instance to handle captive portal logins without altering DNS settings. When enabled, any local user can execute arbitrary commands with the CAP_NET_RAW capability, allowing actions such as binding to privileged ports and spoofing localhost traffic from privileged services. The vulnerability arises from execution with unnecessary privileges (CWE-250). It requires local access and partial privileges but no user interaction. The issue is fixed in versions 25.11 and 26.05. Although no known exploits are reported in the wild, the potential for privilege escalation and network spoofing poses risks, especially in multi-user environments.
The NixOs Odoo package is an open source ERP and CRM system. From 21.11 to before 25.11 and 26.05, every NixOS based Odoo setup publicly exposes the database manager without any authentication. This allows unauthorized actors to delete and download the entire database, including Odoos file store. Unauthorized access is evident from http requests. If kept, searching access logs and/or Odoos log for requests to /web/database can give indicators, if this has been actively exploited. The database manager is a featured intended for development and not meant to be publicly reachable. On other setups, a master password acts as 2nd line of defence. However, due to the nature of NixOS, Odoo is not able to modify its own configuration file and thus unable to persist the auto-generated password. This also applies when manually setting a master password in the web-UI. This means, the password is lost when restarting Odoo. When no password is set, the user is prompted to set one directly via the database manager. This requires no authentication or action by any authorized user or the system administrator. Thus, the database is effectively world readable by anyone able to reach Odoo. This vulnerability is fixed in 25.11 and 26.05.
Tandoor Recipes is a recipe manager than can be installed with the Nix package manager. Starting in version 23.05 and prior to version 26.05, when using the default configuration of Tandoor Recipes, specifically using SQLite and default `MEDIA_ROOT`, the full database file may be externally accessible, potentially on the Internet. The root cause is that the NixOS module configures the working directory of Tandoor Recipes, as well as the value of `MEDIA_ROOT`, to be `/var/lib/tandoor-recipes`. This causes Tandoor Recipes to create its `db.sqlite3` database file in the same directory as `MEDIA_ROOT` causing it to be accessible without authentication through HTTP like any other media file. This is the case when using `GUNICORN_MEDIA=1` or when using a web server like nginx to serve media files. NixOS 26.05 changes the default value of `MEDIA_ROOT` to a sub folder of the data directory. This only applies to configurations with `system.stateVersion` >= 26.05. For older configurations, one of the workarounds should be applied instead. NixOS 25.11 has received a backport of this patch, though it doesn't fix this vulnerability without user intervention. A recommended workaround is to move `MEDIA_ROOT` into a subdirectory. Non-recommended workarounds include switching to PostgreSQL or disallowing access to `db.sqlite3`.
CVE-2025-64766 is a medium-severity vulnerability in NixOS nixpkgs affecting the OnlyOffice document server module. It involves the use of a hard-coded secret to protect the file cache, allowing an attacker who knows a document's revision ID to access that document. The vulnerability affects versions from 22.11 up to but not including 25.05, and unstable versions before 25.11. Exploitation does not require authentication or user interaction but does require knowledge of a valid revision ID, which is considered difficult to obtain. The primary impact is unauthorized read access to documents that users may no longer have permission to access, potentially exposing sensitive information. The issue was fixed in NixOS versions 25.05 and unstable 25.
Hydra is a continuous integration service for Nix based projects. Prior to commit f7bda02, /api/push-github and /api/push-gitea are called by the corresponding forge without HTTP Basic authentication. Both forges do however feature HMAC signing with a secret key. Triggering an evaluation can be very taxing on the infrastructure when large evaluations are done, introducing potential denial of service attacks on the host running the evaluator. This issue has been patched by commit f7bda02. A workaround involves blocking /api/push-github and /api/push-gitea via a reverse proxy.
Hydra is a continuous integration service for Nix based projects. Prior to commit dea1e16, a malicious package can introduce arbitrary JavaScript code into the Hydra database that is automatically evaluated in a client's browser when anyone visits the build page. This could be done by a third-party project as part of its build process. This also happens in other places like with hydra-release-name. This issue has been patched by commit dea1e16. A workaround involves either not building untrusted packages or not visiting the builds page.
Nix is a package manager for Linux and other Unix systems. Builds with Nix 2.30.0 on macOS were executed with elevated privileges (root), instead of the build users. The fix was applied to Nix 2.30.1. No known workarounds are available.
A race condition in the Nix, Lix, and Guix package managers enables changing the ownership of arbitrary files to the UID and GID of the build user (e.g., nixbld* or guixbuild*). This affects Nix before 2.24.15, 2.26.4, 2.28.4, and 2.29.1; Lix before 2.91.2, 2.92.2, and 2.93.1; and Guix before 1.4.0-38.0e79d5b.
The Nix, Lix, and Guix package managers fail to properly set permissions when a derivation build fails. This may allow arbitrary processes to modify the content of a store outside of the build sandbox. This affects Nix before 2.24.15, 2.26.4, 2.28.4, and 2.29.1; Lix before 2.91.2, 2.92.2, and 2.93.1; and Guix before 1.4.0-38.0e79d5b.
The Nix, Lix, and Guix package managers default to using temporary build directories in a world-readable and world-writable location. This allows standard users to deceive the package manager into using directories with pre-existing content, potentially leading to unauthorized actions or data manipulation. This affects Nix before 2.24.15, 2.26.4, 2.28.4, and 2.29.1; Lix before 2.91.2, 2.92.2, and 2.93.1; and Guix before 1.4.0-38.0e79d5b.