CVE-2026-61828

nixos/mysql : `services.mysql` is configured with insecure authentication by default when used with `mysql` or `percona-server`

View on CVE.org

Published Jul 15, 2026 CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Description

Nixpkgs is a collection of software packages that can be installed with the Nix package manager. Prior to the 25.11 and 26.05 channel fixes, the NixOS module for MySQL services.mysql initializes the MySQL database in a way that allows local users, such as unprivileged web or CGI processes on the same host, to log in as the root user without a password when the service is used with mysql or percona-server. This issue is fixed in the 25.11 and 26.05.

Analysis

Technical impact

The NixOS module for MySQL services initializes the database so that the root MySQL account has no password by default. This insecure configuration, a CWE‑276 vulnerability, allows any system process with local execution rights—such as a web or CGI application—to authenticate as root through the database socket without credentials, giving full control over every database on the host.

Affected Systems

Vulnerable systems are NixOS deployments that use the nixpkgs NixOS module for MySQL services in releases prior to the 25.11 and 26.05 channel fixes. The module supports mysql and percona‑server; both configurations are affected when the root account is left passwordless.

Risk and Exploitability

The CVSS score of 8.5 indicates high severity, yet the EPSS score is below 1%, implying exploitation is expected to be rare but still feasible. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires local access; an attacker who can spawn an unprivileged process on the host can immediately authenticate as root and manipulate all data stored in MySQL instances. The likely attack vector is local execution by an unprivileged user process on the same host.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

NixOS

nixpkgs

affected

Version	Status	Constraints
`< 25.11`	affected	—
`>= 26.05-beta, < 26.05`	affected	—

No data.

Vendor Product Versions

Nixos

Version	Status	Scheme	Platform
`[0,25.11)`	affected	generic	—
`[26.05-beta,26.05)`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade to NixOS 25.11, 26.05 or later, which enforce a password for the root MySQL account.
If an immediate upgrade is not feasible, configure the MySQL service to require a non‑empty password for the root account or disable root access via the SQL socket from untrusted processes by applying file system permissions, firewall rules or mandatory access control policies to prevent local connections from arbitrary users.
Audit existing MySQL installations to identify any remaining passwordless root accounts and apply strong passwords; additionally, configure the MySQL socket or TCP port to be accessible only by trusted users or enforce Mandatory Access Control (e.g., SELinux, AppArmor) to limit local connections.

Generated by OpenCVE AI on August 1, 2026 at 08:55 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.153% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://github.com/NixOS/nixpkgs/commit/3f68d7ad2a6865ff8b4910d89f173d7258bad8dd
https://github.com/NixOS/nixpkgs/commit/4aed47116a8734922763cd8f477467b0a0bcd6d7
https://github.com/NixOS/nixpkgs/commit/f8ee41468a7a8f9ed3a8cc7d017151c2ca6f90b5
https://github.com/NixOS/nixpkgs/pull/534254
https://github.com/NixOS/nixpkgs/pull/534482
https://github.com/NixOS/nixpkgs/pull/534484
https://github.com/NixOS/nixpkgs/security/advisories/GHSA-6qxx-6rg8-c4p8

History

Jul 28, 2026 8:45 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Nixos Nixos nixos
Vendors & Products		Nixos Nixos nixos

Jul 15, 2026 5:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Jul 15, 2026 3:30 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Nixpkgs is a collection of software packages that can be installed with the Nix package manager. Prior to the 25.11 and 26.05 channel fixes, the NixOS module for MySQL services.mysql initializes the MySQL database in a way that allows local users, such as unprivileged web or CGI processes on the same host, to log in as the root user without a password when the service is used with mysql or percona-server. This issue is fixed in the 25.11 and 26.05.
Title		nixos/mysql : `services.mysql` is configured with insecure authentication by default when used with `mysql` or `percona-server`
Weaknesses		CWE-276
References		https://github.com/NixOS/nixpkgs/commit/3f68d7ad2a6865ff8b4910d89f173d7258bad8dd https://github.com/NixOS/nixpkgs/commit/4aed47116a8734922763cd8f477467b0a0bcd6d7 https://github.com/NixOS/nixpkgs/commit/f8ee41468a7a8f9ed3a8cc7d017151c2ca6f90b5 https://github.com/NixOS/nixpkgs/pull/534254 https://github.com/NixOS/nixpkgs/pull/534482 https://github.com/NixOS/nixpkgs/pull/534484 https://github.com/NixOS/nixpkgs/security/advisories/GHSA-6qxx-6rg8-c4p8
Metrics		cvssV4_0 `{'score': 8.5, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}`