CVE-2024-45049 json
Nix Hydra Missing authentication when triggering evaluations
published 2024-08-27 2 y ago modified 2026-06-17 4 mo ago also EUVD-2024-41284
- cvss
- 7.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.6%
- EPSS 0.6% chance of exploitation in 30 days, percentile 49%
- public exploits
- 0
- none known
Summary
Hydra is a Continuous Integration service for Nix based projects. It is possible to trigger evaluations in Hydra without any authentication. Depending on the size of evaluations, this can impact the availability of systems. The problem can be fixed by applying https://github.com/NixOS/hydra/commit/f73043378907c2c7e44f633ad764c8bdd1c947d5 to any Hydra package. Users are advised to upgrade. Users unable to upgrade should deny the `/api/push` route in a reverse proxy. This also breaks the "Evaluate jobset" button in the frontend.
Patch / fix
- NixOS hydra f73043378907c2c7e44f633ad764c8bdd1c947d5
- github.com/NixOS/hydra@f730433 commit
- github.com/NixOS/nixpkgs#337766 pull request
- github.com/NixOS/hydra/security/advisories/GHSA-xv29-v93r-2f5v advisory
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
0.62% chance of exploitation in the next 30 days, higher than 49% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Affected products
- NixOS hydra
Classification
- Weakness
-
- CWE-306 Missing Authentication for Critical Functionality
References
-
github.com
/NixOS/nixpkgs/pull/337766
issue-tracking, patch
-
github.com
/NixOS/hydra/commit/f73043378907c2c7e44f633ad764c8bdd1c947d5
patch
-
github.com
/NixOS/hydra/security/advisories/GHSA-xv29-v93r-2f5v
patch, vendor-advisory
-
mastodon.delroth.net
/@delroth/113029832631860419
third-party-advisory
Sources
- CVE List CVE-2024-45049
- NVD CVE-2024-45049
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.