CVE-2026-61828 Auth bypass in nixpkgs
Local attackers can bypass authentication to access MySQL as root without a password due to insecure default configuration in NixOS.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-61828?
CVE-2026-61828 is a high-severity authentication bypass vulnerability in NixOS nixpkgs, published on 15 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Nixpkgs is a collection of software packages that can be installed with the Nix package manager. Prior to the 25.11 and 26.05 channel fixes, the NixOS module for MySQL services.mysql initializes the MySQL database in a way that allows local users, such as unprivileged web or CGI processes on the same host, to log in as the root user without a password when the service is used with mysql or percona-server. This issue is fixed in the 25.11 and 26.05.
Weakness: CWE-276
Which versions are affected by CVE-2026-61828?
How do I fix CVE-2026-61828?
No fix has been published for CVE-2026-61828 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-61828 being exploited?
There is no known exploitation of CVE-2026-61828 in the wild and no public exploit code.
Sources
Also known as GHSA-6qxx-6rg8-c4p8.