Skip to main content
A Leader in the 2026 Gartner® Magic Quadrant™ for Endpoint Protection. Six years running.Find Out Why
Vulnerability Database/CVE-2026-110453

CVE-2026-110453: Nix Privilege Escalation Vulnerability

CVE-2026-110453 is a privilege escalation vulnerability in Nix that affects unsandboxed installations on macOS and FreeBSD by allowing unauthorized connections from build users. This article covers technical details, affected versions, and remediation strategies.

Published:

CVE-2026-110453 Overview

CVE-2026-110453 is an authorization flaw in the Nix package manager affecting versions before 2.35.3 when running unsandboxed on macOS or FreeBSD. The Nix daemon incorrectly allows connections initiated by build users from daemon clients. This weakness falls under [CWE-863] Incorrect Authorization and provides a local attacker with a limited integrity impact.

The NixOS project documented the issue in the NixOS Security Advisory October 2026. The flaw is scoped to systems where build sandboxing is disabled, which is the default on macOS and FreeBSD.

Critical Impact

A local build user can connect back to the Nix daemon as a privileged client, breaking the authorization boundary between build processes and the daemon on unsandboxed macOS and FreeBSD hosts.

Affected Products

  • Nix package manager versions prior to 2.35.3
  • Unsandboxed Nix installations on macOS
  • Unsandboxed Nix installations on FreeBSD

Discovery Timeline

  • 2026-10-14 - CVE-2026-110453 published to the National Vulnerability Database (NVD)
  • 2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-110453

Vulnerability Analysis

Nix executes package builds as dedicated unprivileged build users managed by the Nix daemon. On Linux the daemon isolates builds with a sandbox, but on macOS and FreeBSD the sandbox is not enabled by default. In this unsandboxed configuration, build users can open connections to the Nix daemon socket and are incorrectly treated as daemon clients.

This improper authorization lets a build process influence daemon state during or after a build. An attacker who controls a build (for example, through a malicious derivation) can leverage the connection to tamper with store objects or trigger daemon operations that should be restricted to privileged clients. The impact is limited to integrity, with no direct confidentiality or availability loss reported.

Root Cause

The root cause is an authorization check that fails to distinguish build users from legitimate daemon clients when the sandbox is off. The daemon treats the originating process as a trusted client because the operating-system-level isolation that normally prevents build users from reaching the socket is absent on macOS and FreeBSD defaults.

Attack Vector

Exploitation requires local access and the ability to run or submit a build on an affected host. The attacker then uses the build-user context to open a client connection to the Nix daemon and issue requests that should be denied. No user interaction is required, and the attack scope changes because the compromised component (the build user) acts on a different security authority (the daemon).

No public proof-of-concept or in-the-wild exploitation has been reported. Technical details are described in the NixOS Security Advisory October 2026.

Detection Methods for CVE-2026-110453

Indicators of Compromise

  • Unexpected client connections to the Nix daemon socket originating from nixbld* build-user UIDs on macOS or FreeBSD hosts.
  • Nix store modifications or daemon operations that correlate in time with active builds but do not match a trusted client invocation.
  • Nix daemon logs showing operations attributed to build-user sessions.

Detection Strategies

  • Inventory macOS and FreeBSD systems running Nix and record the installed version to identify hosts below 2.35.3.
  • Audit the Nix configuration for sandbox = false or missing sandbox directives in /etc/nix/nix.conf.
  • Monitor process-to-socket relationships for the Nix daemon socket and alert when build users initiate client sessions.

Monitoring Recommendations

  • Forward Nix daemon logs and host process telemetry to a central analytics pipeline for correlation with build activity.
  • Baseline normal daemon client identities and alert on deviations, especially UIDs within the nixbld group.
  • Track derivations submitted by untrusted users and review their post-build daemon interactions.

How to Mitigate CVE-2026-110453

Immediate Actions Required

  • Upgrade Nix to version 2.35.3 or later on all macOS and FreeBSD hosts.
  • Restrict which users may submit builds to the Nix daemon, particularly on multi-user systems.
  • Review recent build activity on unsandboxed hosts for anomalous daemon interactions prior to patching.

Patch Information

The Nix project fixed the issue in version 2.35.3. Refer to the NixOS Security Advisory October 2026 for upstream patch details and guidance for both Nix and Lix distributions.

Workarounds

  • Limit daemon access to trusted users by configuring trusted-users and allowed-users in nix.conf to exclude build users.
  • Avoid executing untrusted derivations on affected macOS and FreeBSD hosts until the patched version is deployed.
  • Where feasible, enable sandboxing or isolate build hosts from systems that hold sensitive store contents.
bash
# Configuration example: restrict Nix daemon clients in /etc/nix/nix.conf
trusted-users = root @admin
allowed-users = root @admin
# Then upgrade and restart the daemon
nix --version        # verify >= 2.35.3
sudo launchctl kickstart -k system/org.nixos.nix-daemon   # macOS

Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.

Experience the Most Advanced Cybersecurity Platform

See how the world’s most intelligent, autonomous cybersecurity platform can protect your organization today and into the future.

Try SentinelOne