CVE-2026-61828highCWE-276

CVE-2026-61828: high-severity vulnerability in NixOS nixpkgs

nixos/mysql : `services.mysql` is configured with insecure authentication by default when used with `mysql` or `percona-server`

Published

Follow this CVE+ Monitor nixpkgs

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.5epss 0.2%
Nixpkgs is a collection of software packages that can be installed with the Nix package manager. Prior to the 25.11 and 26.05 channel fixes, the NixOS module for MySQL services.mysql initializes the MySQL database in a way that allows local users, such as unprivileged web or CGI processes on the same host, to log in as the root user without a password when the service is used with mysql or percona-server. This issue is fixed in the 25.11 and 26.05.
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
NixOS · nixpkgs
Related CVEs — NixOS nixpkgs

In the same product, most dangerous first.

CVE-2026-25137CRITICALNixOs Odoo database and filestore publicly accessible with default odoo configurationEPSS 10.3%CVE-2026-23838HIGHTandoor Recipes module allows SQLite database to be externally accessible with the default settingsEPSS 0.5%CVE-2025-64766MEDIUMNixOS has hardcoded credentials in Onlyoffice moduleEPSS 0.3%CVE-2025-32438HIGHLocal privilege escalation in make-initrd-ngEPSS 0.2%CVE-2026-25740MEDIUMPrivilege escalation to the `CAP_NET_RAW` capability via the `programs.captive-browser` NixOS moduleEPSS 0.2%