Incorrect authorization in nix - CVE-2026-110453
Published: October 15, 2026
Vulnerability identifier: #VU155870
CSH Severity: Low
CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-110453
CWE-ID: CWE-863
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to bypass connection restrictions on the Nix daemon.
The vulnerability exists due to incorrect authorization caused by ignoring the effective group ID in the Nix daemon when retrieving peer credentials through the LOCAL_PEERCRED socket option. A local user can connect from an unsandboxed derivation builder belonging to the build-users-group to bypass connection restrictions on the Nix daemon.
The issue occurs on BSD-based systems, including macOS and FreeBSD. Linux uses SO_PEERCRED and is not affected. This exposure can exacerbate separate vulnerabilities in the daemon.
Affected software
nix
How to mitigate CVE-2026-110453
Install security update from vendor's website.
nix - addressed in versions 2.28.8, 2.30.6, 2.31.6, 2.34.9, 2.35.3