CVE-2026-61828highCWE-276

CVE-2026-61828: falha de alta gravidade em NixOS nixpkgs

nixos/mysql : `services.mysql` is configured with insecure authentication by default when used with `mysql` or `percona-server`

Publicada em

Seguir esta CVE+ Monitorar nixpkgs

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.5epss 0.2%
Nixpkgs is a collection of software packages that can be installed with the Nix package manager. Prior to the 25.11 and 26.05 channel fixes, the NixOS module for MySQL services.mysql initializes the MySQL database in a way that allows local users, such as unprivileged web or CGI processes on the same host, to log in as the root user without a password when the service is used with mysql or percona-server. This issue is fixed in the 25.11 and 26.05.
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Produtos afetados
NixOS · nixpkgs
CVEs relacionadas — NixOS nixpkgs

No mesmo produto, das mais perigosas para as menos.

CVE-2026-25137CRITICALNixOs Odoo database and filestore publicly accessible with default odoo configurationEPSS 10.3%CVE-2026-23838HIGHTandoor Recipes module allows SQLite database to be externally accessible with the default settingsEPSS 0.5%CVE-2025-64766MEDIUMNixOS has hardcoded credentials in Onlyoffice moduleEPSS 0.3%CVE-2025-32438HIGHLocal privilege escalation in make-initrd-ngEPSS 0.2%CVE-2026-25740MEDIUMPrivilege escalation to the `CAP_NET_RAW` capability via the `programs.captive-browser` NixOS moduleEPSS 0.2%