CVE-2024-45049: NixOS Hydra Auth Bypass Vulnerability

CVE-2024-45049 Overview

CVE-2024-45049 affects Hydra, the continuous integration (CI) service for Nix-based projects maintained by NixOS. The flaw allows unauthenticated remote attackers to trigger jobset evaluations through the /api/push route. Because evaluations can consume significant compute resources, repeated requests can degrade or exhaust the availability of the Hydra instance. The issue is categorized as Missing Authentication for Critical Function [CWE-306] and impacts the availability of affected systems without exposing confidentiality or integrity.

Critical Impact
An unauthenticated network attacker can repeatedly invoke expensive Nix evaluations on a Hydra server, exhausting CPU and memory and causing a denial-of-service condition.

Affected Products

NixOS Hydra (all versions prior to the patched commit f7304337)
Hydra packages distributed through nixpkgs prior to pull request 337766
Any deployment exposing the Hydra /api/push endpoint to untrusted networks

Discovery Timeline

2024-08-27 - CVE-2024-45049 published to the National Vulnerability Database
2025-09-22 - Last updated in NVD database

Technical Details for CVE-2024-45049

Vulnerability Analysis

Hydra exposes a REST endpoint at /api/push that triggers evaluations of one or more jobsets. Prior to the fix, this controller action did not verify the caller's identity or permissions. Any unauthenticated client able to reach the Hydra web interface could submit a request and force the server to enqueue jobset evaluations.

Nix evaluations are computationally expensive. They parse and instantiate large derivation graphs, often consuming substantial CPU time and memory. By scripting repeated requests against /api/push, an attacker can saturate evaluator workers and prevent legitimate builds from completing. The vulnerability is network-reachable, requires no privileges, and needs no user interaction.

Root Cause

The push action in src/lib/Hydra/Controller/API.pm invoked triggerJobset for every jobset referenced in the request without first checking that the caller held the required role. The Hydra role configuration in src/lib/Hydra/Config.pm also lacked a dedicated eval-jobset privilege, so there was no granular permission to enforce.

Attack Vector

Exploitation requires only HTTP access to the Hydra instance. An attacker submits a GET or POST request to /api/push with jobsets or repos query parameters. The server then iterates the supplied jobsets and triggers evaluations on behalf of the anonymous caller. Repeated invocations against large jobsets cause sustained resource exhaustion.

The official fix introduces a new eval-jobset role and guards the controller path with requireEvalJobsetPrivileges:

perl

            "hydra_bump-to-front" => [ "bump-to-front" ],
            "hydra_cancel-build" => [ "cancel-build" ],
            "hydra_create-projects" => [ "create-projects" ],
+           "hydra_eval-jobset" => [ "eval-jobset" ],
            "hydra_restart-jobs" => [ "restart-jobs" ],

perl

    foreach my $s (@jobsets) {
        my ($p, $j) = parseJobsetName($s);
        my $jobset = $c->model('DB::Jobsets')->find($p, $j);
+       requireEvalJobsetPrivileges($c, $jobset->project);
        next unless defined $jobset && ($force || ($jobset->project->enabled && $jobset->enabled));
        triggerJobset($self, $c, $jobset, $force);
    }

Source: NixOS/hydra commit f7304337

Detection Methods for CVE-2024-45049

Indicators of Compromise

HTTP requests to /api/push originating from unauthenticated sources or unexpected IP ranges
Bursts of evaluator process activity (hydra-eval-jobset) without a corresponding logged-in user action
Sudden growth in evaluation queue depth or sustained high CPU on the Hydra evaluator host
Reverse-proxy access logs showing repeated /api/push?jobsets= or /api/push?repos= query patterns

Detection Strategies

Parse reverse-proxy (nginx, Apache, Caddy) access logs for /api/push requests lacking a session cookie or Authorization header
Correlate evaluator process spawn events with web request timestamps to identify anonymous triggers
Baseline normal evaluation frequency per jobset and alert on deviations

Monitoring Recommendations

Forward Hydra and reverse-proxy logs to a centralized SIEM or data lake for correlation across hosts
Track host-level metrics (CPU, memory, evaluator queue length) and alert on sustained saturation
Monitor outbound network behavior of the Hydra host to detect any secondary abuse that follows resource exhaustion

How to Mitigate CVE-2024-45049

Immediate Actions Required

Upgrade Hydra to a build that includes commit f73043378907c2c7e44f633ad764c8bdd1c947d5 or the nixpkgs pull request 337766
Audit user accounts and assign the new eval-jobset role only to trusted operators
Restrict network access to the Hydra web interface so that only authenticated internal users can reach /api/push
Review reverse-proxy logs for prior anonymous requests to /api/push and investigate any anomalous evaluation activity

Patch Information

The fix is published in the upstream Hydra commit f7304337 and tracked in the GitHub Security Advisory GHSA-xv29-v93r-2f5v. The corresponding nixpkgs update is delivered through pull request 337766. The patch introduces an eval-jobset role and calls requireEvalJobsetPrivileges before triggering any jobset evaluation.

Workarounds

Deny the /api/push route at the reverse proxy until the patch can be applied; note this also disables the "Evaluate jobset" button in the frontend
Place the Hydra instance behind a VPN or authenticated proxy so that anonymous internet access is removed
Apply rate limiting on /api/push to slow exploitation while a permanent fix is staged

bash

# nginx workaround: block anonymous access to /api/push
location = /api/push {
    deny all;
    return 403;
}