Nixpkgs EUVD-2026-44690

Requires an existing local, unprivileged foothold on the host (per CVSS AV:L/PR:L) AND the NixOS services.mysql module deployed with the mysql (Oracle MySQL) or percona-server package on a channel prior to the 25.11/26.05 fix, with root@localhost still on default password/native authentication rather than auth_socket. Concretely, the local account must be able to reach the MySQL Unix socket or loopback interface. Limiting factors: exploitation is NOT possible remotely (local vector only); it does NOT apply to MariaDB-based services.mysql deployments (secure by default); it does not apply once secureSuperUserByDefault has converted root@localhost to auth_socket or the operator has otherwise set root authentication; and it requires that some lower-trust local process already exists to abuse the passwordless root login.

The vendor CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H, score 8.5) is internally consistent with the description: local vector, low complexity, low privileges (any local account) yielding high confidentiality, integrity, and availability impact over the database. No EPSS score, KEV entry, or published POC was provided, so exploitation-probability signals are absent - this reflects missing telemetry, not confirmed low risk. Practical risk is high where the precondition holds because an existing unprivileged local process (a web/CGI worker) is common on web-serving or multi-tenant hosts, and exploitation is then a single passwordless mysql login. The mitigating factor is that this is strictly local (AV:L): there is no remote/network path, so exposure is bounded to hosts running the vulnerable NixOS MySQL/Percona config alongside lower-trust local processes. Note PR:L means a local foothold is required - this is not remote-unauthenticated despite the high impact.

An attacker controlling a low-privilege local process - for example an exploited PHP/CGI web worker running as the www or nobody user on a NixOS host running services.mysql with the mysql package - simply runs 'mysql -u root' over the local socket and is accepted as root@localhost with no password. From there they read or modify every database, create new privileged DB accounts, or abuse MySQL file/UDF features to escalate further. No public POC is needed since exploitation is a single native mysql client command.