CVE-2026-110452: Nix Privilege Escalation Vulnerability

CVE-2026-110452 Overview

CVE-2026-110452 affects the Nix package manager multi-user installer in versions before 2.35.3. The installer assigns ownership of Nix store contents to the invoking user instead of root. This introduces an incorrect ownership assignment flaw [CWE-708] that undermines the security boundary expected from a multi-user installation. A local user who originally ran the installer gains write access to store paths that should be owned by root, enabling tampering with build artifacts shared across users on the same host.

Critical Impact
A local user can modify Nix store contents that should be protected by root ownership, compromising the integrity of binaries and derivations used by other users on the same system.

Affected Products

Nix package manager, multi-user installer, versions prior to 2.35.3
NixOS systems provisioned with the affected multi-user installer
Lix installations referenced in the shared October 2026 advisory

Discovery Timeline

2026-10-14 - CVE CVE-2026-110452 published to the National Vulnerability Database (NVD)
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-110452

Vulnerability Analysis

The Nix multi-user installer provisions the /nix/store directory and the daemon-based build environment used by all local users. In a correctly configured multi-user deployment, store paths and their contents are owned by root and served to users through the nix-daemon. This separation prevents any non-privileged user from modifying build outputs that other users execute.

In affected installer versions, the ownership of store contents is set to the user who invoked the installer. That user retains direct write access to files inside the store after installation completes. Because the daemon trusts the integrity of files it serves, tampering with these files allows the installing user to influence the behavior of commands executed by other users or by system services that depend on those store paths.

The issue is a local, integrity-focused flaw. It does not expose confidential data on its own and does not provide a network-reachable attack surface, but it violates the trust model that the multi-user mode is intended to enforce.

Root Cause

The installer uses an incorrect ownership assignment [CWE-708] when copying or materializing the initial store contents. Rather than invoking chown root:root (or the equivalent) on all store paths, the installer preserves the invoking user's UID and GID. The condition persists after installation because Nix does not automatically re-validate ownership of pre-existing store entries during daemon startup.

Attack Vector

Exploitation requires local access as the user who ran the installer, or as any user who later gains control of that account. The actor modifies files under /nix/store that should be immutable to non-root users, such as scripts, binaries, or configuration fragments referenced by shared derivations. When another user or a privileged service subsequently invokes those paths, it executes the tampered content under its own identity.

No exploit code is publicly available for CVE-2026-110452, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. See the NixOS Security Advisory - October 2026 for the maintainers' technical description.

Detection Methods for CVE-2026-110452

Indicators of Compromise

Files under /nix/store owned by a UID other than 0 (root), particularly matching the UID of the account that originally executed the installer.
Unexpected modification timestamps (mtime) on store paths that should be immutable after their initial realization.
Store path hashes that no longer match the output of nix-store --verify --check-contents.

Detection Strategies

Run find /nix/store -not -user root -print on multi-user installations to enumerate incorrectly owned paths.
Execute nix-store --verify --check-contents to flag store entries whose contents diverge from their recorded NAR hashes.
Compare installed Nix version against 2.35.3 using nix --version to confirm whether a given host is in scope.

Monitoring Recommendations

Alert on write operations to /nix/store performed by any non-root UID using file integrity monitoring or audit rules.
Track execution of chown, chmod, or install commands targeting /nix/store paths outside of nix-daemon activity.
Record daemon logs and correlate build output hashes over time to identify silent substitutions.

How to Mitigate CVE-2026-110452

Immediate Actions Required

Upgrade the Nix package manager to version 2.35.3 or later on all multi-user installations.
Reset ownership of existing store contents to root using chown -R root:root /nix/store after confirming no in-flight builds are running.
Audit accounts that previously held ownership of store paths and rotate any credentials or SSH keys associated with those accounts if tampering is suspected.

Patch Information

The Nix maintainers resolved the ownership defect in version 2.35.3. Refer to the NixOS Security Advisory - October 2026 for upgrade guidance and for the corresponding Lix fix. After upgrading, re-run the installer's post-install ownership steps or apply the ownership correction manually, because the patched installer only prevents future misconfiguration and does not retroactively repair store contents on previously provisioned hosts.

Workarounds

Manually enforce root:root ownership on /nix/store and its contents, then verify integrity with nix-store --verify --check-contents.
Restrict interactive login for the account that originally executed the installer until ownership has been corrected.
On shared hosts where upgrade is not immediately possible, limit who can execute arbitrary Nix builds and treat the system as single-user until remediation completes.

bash

# Correct ownership of the Nix store on affected multi-user installations
sudo chown -R root:root /nix/store
sudo nix-store --verify --check-contents
nix --version   # confirm 2.35.3 or later