Incorrect Ownership Assignment in nix - CVE-2026-110452
Published: October 15, 2026
Vulnerability identifier: #VU155869
CSH Severity: Medium
CVSS v4: 7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-110452
CWE-ID: CWE-708
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local privileged user to execute arbitrary code as root.
The vulnerability exists due to incorrect ownership assignment in the multi-user bootstrap installer when installation is initiated by an unprivileged user. A local privileged user can replace the nix binary or its dependencies left under the invoking user's ownership in the store to execute arbitrary code as root when the init system launches nix.
Users included in the trusted-users list already have the ability to delete and replace arbitrary store objects.
Affected software
nix
How to mitigate CVE-2026-110452
Install security update from vendor's website.
nix - addressed in versions 2.28.8, 2.30.6, 2.31.6, 2.34.9, 2.35.3