Improper Authorization in nix - CVE-2026-110450
Published: October 15, 2026
Vulnerability details
The vulnerability allows a local user to corrupt arbitrary store objects and escalate privileges.
The vulnerability exists due to improper authorization in the nix-daemon AddToStoreNar and AddMultipleToStore operations when processing client-supplied NAR contents in repair mode. A local user can submit crafted NAR contents with the repair flag enabled to corrupt arbitrary store objects and escalate privileges.
Exploitation is available to users matched by allowed-users even when they are not listed in trusted-users. Privilege escalation requires a privileged service to execute files from a corrupted store object; in multi-user configurations, the Nix daemon itself can provide this execution path when running as root.