CVE-2026-25740

Privilege escalation to the `CAP_NET_RAW` capability via the `programs.captive-browser` NixOS module

Published Feb 9, 2026 CVSS 4.0 · 5.8 Medium EPSS < 1% KEV · Not listed

Description

captive browser, a dedicated Chrome instance to log into captive portals without messing with DNS settings. In 25.05 and earlier, when programs.captive-browser is enabled, any user of the system can run arbitrary commands with the CAP_NET_RAW capability (binding to privileged ports, spoofing localhost traffic from privileged services...). This vulnerability is fixed in 25.11 and 26.05.

Analysis

Technical impact

A user can trigger the programs.captive-browser module to run arbitrary commands with the CAP_NET_RAW capability, allowing binding to privileged ports and spoofing localhost traffic. The weakness stems from improper privilege assignment (CWE-250) and can compromise system networking functions if exploited. The impact is confined to the user’s own session but grants elevated low‑level network control.

Affected Systems

This issue affects NixOS installations using the nixpkgs 25.05 release or earlier that enable the programs.captive-browser module. It is fixed in nixpkgs 25.11 and 26.05.

Risk and Exploitability

The CVSS score is 5.8 and the EPSS score is below 1%, indicating a moderate severity with low exploitation probability. The vulnerability is not listed in the KEV catalog. The likely attack vector is local, requiring an authenticated or otherwise logged‑in user to enable the module or execute commands within the system. No remote trigger is described, so a local privileged user can reach the CAP_NET_RAW capability through this path.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

NixOS

nixpkgs

affected

Version	Status	Constraints
`<= 25.05`	affected	—

No data.

Vendor Product Versions

Nixos

Captive-browser

Version	Status	Scheme	Platform
`[0,25.05]`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade to nixpkgs 25.11 or later (e.g., 26.05) where the vulnerability is patched
If the captive browser feature is unnecessary, disable programs.captive-browser in the system configuration
Ensure that only trusted users have shell access to run the captive‑browser module

Generated by OpenCVE AI on April 17, 2026 at 21:14 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Attack Requirements Present

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.164% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/NixOS/nixpkgs/pull/487775
https://github.com/NixOS/nixpkgs/pull/487779
https://github.com/NixOS/nixpkgs/security/advisories/GHSA-wc3r-c66x-8xmc

History

Feb 10, 2026 5:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Feb 10, 2026 3:45 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Nixos Nixos captive-browser
Vendors & Products		Nixos Nixos captive-browser

Feb 9, 2026 8:30 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		captive browser, a dedicated Chrome instance to log into captive portals without messing with DNS settings. In 25.05 and earlier, when programs.captive-browser is enabled, any user of the system can run arbitrary commands with the CAP_NET_RAW capability (binding to privileged ports, spoofing localhost traffic from privileged services...). This vulnerability is fixed in 25.11 and 26.05.
Title		Privilege escalation to the `CAP_NET_RAW` capability via the `programs.captive-browser` NixOS module
Weaknesses		CWE-250
References		https://github.com/NixOS/nixpkgs/pull/487775 https://github.com/NixOS/nixpkgs/pull/487779 https://github.com/NixOS/nixpkgs/security/advisories/GHSA-wc3r-c66x-8xmc
Metrics		cvssV4_0 `{'score': 5.8, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N'}`