Nixpkgs security tracker

Login with GitHub
⚠️ You are using a production deployment that is still only suitable for demo purposes. Any work done in this might be wiped later without notice.

Suggestions search

Untriaged
Filter by:
With package: nixpkgs-track

Found 1 matching suggestions

View:
Compact
Detailed
Permalink CVE-2026-61828
8.5 HIGH
  • CVSS version (CVSS): 4.0
  • Attack Vector (AV): Local (L)
  • Attack Complexity (AC): Low (L)
  • Attack Requirement (AT): None (N)
  • Privileges Required (PR): Low (L)
  • User Interaction (UI): None (N)
  • Vulnerable System Impact Confidentiality (VC): High (H)
  • Vulnerable System Impact Integrity (VI): High (H)
  • Vulnerable System Impact Availability (VA): High (H)
  • Subsequent System Impact Confidentiality (SC): None (N)
  • Subsequent System Impact Integrity (SI): None (N)
  • Subsequent System Impact Availability (SA): None (N)
  • Modified Attack Vector (MAV): Local (L)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Attack Requirement (MAT): None (N)
  • Modified Privileges Required (MPR): Low (L)
  • Modified User Interaction (MUI): None (N)
  • Modified Vulnerable System Impact Confidentiality (MVC): High (H)
  • Modified Vulnerable System Impact Integrity (MVI): High (H)
  • Modified Vulnerable System Impact Availability (MVA): High (H)
  • Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
  • Modified Subsequent System Impact Integrity (MSI): Negligible (N)
  • Modified Subsequent System Impact Availability (MSA): Negligible (N)
  • Safety (S): Not Defined (X)
  • Automatable (AU): Not Defined (X)
  • Recovery (R): Not Defined (X)
  • Value Density (V): Not Defined (X)
  • Vulnerability Response Effort (RE): Not Defined (X)
  • Provider Urgency (U): Not Defined (X)
  • Confidentiality Req. (CR): Not Defined (X)
  • Integrity Req. (IR): Not Defined (X)
  • Availability Req. (AR): Not Defined (X)
  • Exploit Maturity (E): Not Defined (X)
created 1 month, 2 weeks ago Activity log
  • Created suggestion 1 month, 2 weeks ago
nixos/mysql : `services.mysql` is configured with insecure authentication by default when used with `mysql` or `percona-server`

Nixpkgs is a collection of software packages that can be installed with the Nix package manager. Prior to the 25.11 and 26.05 channel fixes, the NixOS module for MySQL services.mysql initializes the MySQL database in a way that allows local users, such as unprivileged web or CGI processes on the same host, to log in as the root user without a password when the service is used with mysql or percona-server. This issue is fixed in the 25.11 and 26.05.

Affected products

nixpkgs
  • ==>= 26.05-beta, < 26.05
  • ==< 25.11

Matching in nixpkgs

pkgs.manual

None

  • nixos-unstable -
    • nixos-unstable-small 26.11
  • nixos-26.05 -
    • nixos-26.05-small 26.05

pkgs.metrics

Metrics tracked by Hydra about Nixpkgs

  • nixos-unstable -
    • nixos-unstable-small
  • nixos-26.05 -
    • nixos-26.05-small

pkgs.nixpkgs-fmt

Nix code formatter for nixpkgs

  • nixos-unstable -
    • nixos-unstable-small 1.3.0
  • nixos-26.05 -
    • nixos-26.05-small 1.3.0

pkgs.nixpkgs-vet

Tool to vet (check) Nixpkgs, including its pkgs/by-name directory

  • nixos-unstable -
    • nixos-unstable-small 0.3.4
  • nixos-26.05 -
    • nixos-26.05-small 0.3.0

pkgs.nixpkgs-lint

A utility for Nixpkgs contributors to check Nixpkgs for common errors

  • nixos-unstable -
    • nixos-unstable-small 1
  • nixos-26.05 -
    • nixos-26.05-small 1

pkgs.dhall-nixpkgs

Convert Dhall projects to Nix packages

  • nixos-unstable -
  • nixos-26.05 -

pkgs.nixpkgs-track

Track where Nixpkgs pull requests have reached

  • nixos-unstable -
    • nixos-unstable-small 0.6.0
  • nixos-26.05 -
    • nixos-26.05-small 0.6.0

pkgs.nixpkgs-review

Review pull-requests on https://github.com/NixOS/nixpkgs

  • nixos-unstable -
    • nixos-unstable-small 3.9.0
  • nixos-26.05 -
    • nixos-26.05-small 3.9.0

pkgs.release-checks

None

  • nixos-unstable -
    • nixos-unstable-small
  • nixos-26.05 -
    • nixos-26.05-small

pkgs.nixpkgs-pytools

Tools for removing the tedious nature of creating nixpkgs derivations

  • nixos-unstable -
    • nixos-unstable-small 1.3.0
  • nixos-26.05 -
    • nixos-26.05-small 1.3.0

pkgs.nixpkgs-reviewFull

Review pull-requests on https://github.com/NixOS/nixpkgs

  • nixos-unstable -
    • nixos-unstable-small 3.9.0
  • nixos-26.05 -
    • nixos-26.05-small 3.9.0