The NixOS module for MySQL services initializes the database so that the root MySQL account has no password by default. This insecure configuration, a CWE‑276 vulnerability, allows any system process with local execution rights—such as a web or CGI application—to authenticate as root through the database socket without credentials, giving full control over every database on the host.

Vulnerable systems are NixOS deployments that use the nixpkgs NixOS module for MySQL services in releases prior to the 25.11 and 26.05 channel fixes. The module supports mysql and percona‑server; both configurations are affected when the root account is left passwordless.

The CVSS score of 8.5 indicates high severity, yet the EPSS score is below 1%, implying exploitation is expected to be rare but still feasible. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires local access; an attacker who can spawn an unprivileged process on the host can immediately authenticate as root and manipulate all data stored in MySQL instances. The likely attack vector is local execution by an unprivileged user process on the same host.