EUVD-2026-44690Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Any local account can log in as MySQL root over the socket, so AV:L/AC:L/PR:L/UI:N with full C/I/A over the database; scope unchanged as impact stays within the DBMS.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
Nixpkgs is a collection of software packages that can be installed with the Nix package manager. Prior to the 25.11 and 26.05 channel fixes, the NixOS module for MySQL services.mysql initializes the MySQL database in a way that allows local users, such as unprivileged web or CGI processes on the same host, to log in as the root user without a password when the service is used with mysql or percona-server. This issue is fixed in the 25.11 and 26.05.
AnalysisAI
Local privilege escalation to MySQL root in the NixOS services.mysql module (Nixpkgs, before the 25.11 and 26.05 channel fixes) lets any unprivileged local account - including web, CGI, or other service processes on the same host - authenticate as the database root@localhost user with no password when the module is deployed with the mysql or percona-server package. Because the module initialized root@localhost without socket or password authentication, the DBMS trusted any local connection as root, granting full read/write control over all databases. No public exploit code has been identified at time of analysis and it is not in CISA KEV, but exploitation is trivial for any local process meeting the precondition.
Technical ContextAI
The affected component is the NixOS module nixos/modules/services/databases/mysql.nix in Nixpkgs, which declaratively provisions MySQL (Oracle MySQL) or Percona Server instances. The root cause is CWE-276 (Incorrect Default Permissions): during first-time database initialization the module left root@localhost using the default mysql_native_password authentication with an empty credential rather than the auth_socket (Unix socket peer-credential) plugin. With auth_socket, MySQL verifies the connecting OS user via the local socket and only lets the actual system root assume DB root; without it, any local user who can reach the MySQL Unix socket or loopback is accepted as root@localhost. The upstream fix adds a services.mysql.secureSuperUserByDefault option (default true) that runs 'ALTER USER root@localhost IDENTIFIED WITH auth_socket;' at initialization and attempts to remediate existing insecure deployments; it explicitly excludes MariaDB, which already ships with auth_socket for root by default.
RemediationAI
Vendor-released patch: update Nixpkgs/NixOS to the fixed 25.11 or 26.05 channel and rebuild, applying the services.mysql module change that sets root@localhost to auth_socket authentication for mysql and percona-server (see advisory GHSA-6qxx-6rg8-c4p8 and PR https://github.com/NixOS/nixpkgs/pull/534254). The new services.mysql.secureSuperUserByDefault option defaults to true and, for stateVersion 26.11+, auto-remediates existing insecure instances; on older stateVersions the module only emits a warning, so operators of pre-existing databases should manually run 'ALTER USER root@localhost IDENTIFIED WITH auth_socket;' as the DB superuser after confirming the system root user can still authenticate via the socket. If you cannot update immediately, manually convert root@localhost to auth_socket (side effect: only the OS root account, not password logins, can act as DB root - update automation that logged in as root with a password), or set a strong password on root@localhost via ALTER USER (side effect: breaks scripts expecting passwordless root). Additionally restrict access to the MySQL Unix socket and bind MySQL to loopback only so untrusted local processes cannot reach it, though this does not help against processes already on the same host with socket access. Migrating the service to MariaDB is also an option, as it is not vulnerable.
A flaw was found in rsync which could be triggered when rsync compares file checksums. Rated high severity (CVSS 7.5), t
A heap-based buffer overflow flaw was found in the rsync daemon. Rated critical severity (CVSS 9.8), this vulnerability
Local privilege escalation in Nix package manager daemon (versions prior to 2.34.5/2.33.4/2.32.7/2.31.4/2.30.4/2.29.3/2.
Server-to-client path traversal in rsync lets a malicious or compromised rsync server write files outside the client's i
Nix through 2.3 allows local users to gain access to an arbitrary user's account because the parent directory of the use
A flaw was found in rsync. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authenticati
calamares-nixos-extensions provides Calamares branding and modules for NixOS, a distribution of GNU/Linux. Rated medium
Nix is a package manager for Linux and other Unix systems. Rated high severity (CVSS 8.8), this vulnerability is remotel
Arbitrary file write outside the intended destination in rsync's client-side `--safe-links` handling allows a malicious
NixOS 17.03 before 17.03.887 has a world-writable Docker socket, which allows local users to gain privileges by executin
Hydra is a Continuous Integration service for Nix based projects. Rated high severity (CVSS 7.5), this vulnerability is
NixOS 17.03 and earlier has an unintended default absence of SSL Certificate Validation for LDAP. Rated medium severity
Same weakness CWE-276 – Incorrect Default Permissions
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today