Nixpkgs security tracker

Try the new UI
Login with GitHub
⚠️ You are using a production deployment that is still only suitable for demo purposes. Any work done in this might be wiped later without notice.

Suggestion detail

Dismissed
(not in Nixpkgs)
Permalink CVE-2026-33388
6.4 MEDIUM
  • CVSS version (CVSS): 4.0
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Attack Requirement (AT): None (N)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Vulnerable System Impact Confidentiality (VC): Low (L)
  • Vulnerable System Impact Integrity (VI): Low (L)
  • Vulnerable System Impact Availability (VA): Low (L)
  • Subsequent System Impact Confidentiality (SC): High (H)
  • Subsequent System Impact Integrity (SI): Low (L)
  • Subsequent System Impact Availability (SA): Low (L)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Attack Requirement (MAT): None (N)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
  • Modified Vulnerable System Impact Integrity (MVI): Low (L)
  • Modified Vulnerable System Impact Availability (MVA): Low (L)
  • Modified Subsequent System Impact Confidentiality (MSC): High (H)
  • Modified Subsequent System Impact Integrity (MSI): Low (L)
  • Modified Subsequent System Impact Availability (MSA): Low (L)
  • Safety (S): Not Defined (X)
  • Automatable (AU): Not Defined (X)
  • Recovery (R): Not Defined (X)
  • Value Density (V): Not Defined (X)
  • Vulnerability Response Effort (RE): Not Defined (X)
  • Provider Urgency (U): Not Defined (X)
  • Confidentiality Req. (CR): Not Defined (X)
  • Integrity Req. (IR): Not Defined (X)
  • Availability Req. (AR): Not Defined (X)
  • Exploit Maturity (E): Not Defined (X)
updated 1 week, 4 days ago by @fricklerhandwerk Activity log
  • Created suggestion 1 week, 4 days ago
  • @fricklerhandwerk dismissed (not in Nixpkgs) 1 week, 4 days ago
Incorrect authorization in Credentials Manager in Guardian/CMC before 26.3.0

An access control vulnerability was discovered in the Credentials Manager functionality due to insufficient validation of user privileges. A remote authenticated user with limited privileges can view a limited subset of the available entries in the Credentials Manager. The actual credential values are not directly visible, but the user can delete entries or edit their properties. An attacker who deletes or edits an entry can disrupt authentication for dependent devices, and one who manipulates an entry's configuration may be able to indirectly obtain the credentials.

Affected products

CMC
  • <26.3.0
Guardian
  • <26.3.0

Matching in nixpkgs

pkgs.cmc

Manages SSH ControlMaster sessions

pkgs.cmctl

Command line utility to interact with a cert-manager installation on Kubernetes

pkgs.scmccid

PCSC drivers for linux, for the SCM SCR3310 v2.0 card and others

pkgs.adguardian

Terminal-based, real-time traffic monitoring and statistics for your AdGuard Home instance

pkgs.pcmciaUtils

None

  • nixos-unstable 018
    • nixpkgs-unstable 018
    • nixos-unstable-small 018
  • nixos-26.05 018
    • nixos-26.05-small 018
    • nixpkgs-26.05-darwin 018

pkgs.pcmciautils

None

  • nixos-unstable 018
    • nixpkgs-unstable 018
    • nixos-unstable-small 018
  • nixos-26.05 018
    • nixos-26.05-small 018
    • nixpkgs-26.05-darwin 018

Package maintainers