nixos/mysql : `services.mysql` is configured with insecure authentication by default when used with `mysql` or `percona-server`

published 2026-07-15 3 mo ago modified 2026-10-24 15 d ago also EUVD-2026-44690

cvss: 8.5; version 4.0, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.2%; EPSS 0.2% chance of exploitation in 30 days, percentile 4%
public exploits: 0; none known

Nixpkgs is a collection of software packages that can be installed with the Nix package manager. Prior to the 25.11 and 26.05 channel fixes, the NixOS module for MySQL services.mysql initializes the MySQL database in a way that allows local users, such as unprivileged web or CGI processes on the same host, to log in as the root user without a password when the service is used with mysql or percona-server. This issue is fixed in the 25.11 and 26.05.

Patch / fix

links 6

github.com/NixOS/nixpkgs@3f68d7a commit
github.com/NixOS/nixpkgs@4aed471 commit
github.com/NixOS/nixpkgs@f8ee414 commit
github.com/NixOS/nixpkgs#534254 pull request
github.com/NixOS/nixpkgs#534482 pull request
github.com/NixOS/nixpkgs#534484 pull request

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: total
Assessed: 3 mo ago (2026-07-15)

Exploit prediction

0.15% chance of exploitation in the next 30 days, higher than 4% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	4.0	8.5	CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CNA	4.0	8.5	CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected products

NixOS nixpkgs

Classification

Weakness

CWE-276 Incorrect Default Permissions

References

Sources

CVE List CVE-2026-61828
NVD CVE-2026-61828

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary