CVE-2026-61828: Nixpkgs MySQL Auth Bypass Vulnerability

CVE-2026-61828 Overview

CVE-2026-61828 affects Nixpkgs, the collection of software packages installed via the Nix package manager. The NixOS services.mysql module initializes the MySQL database in an insecure state when configured with mysql or percona-server. Local unprivileged users, including web server and CGI processes running on the same host, can authenticate as the MySQL root user without supplying a password. The flaw is tracked under [CWE-276: Incorrect Default Permissions] and is fixed in the 25.11 and 26.05 channels of Nixpkgs.

Critical Impact
Any local account on an affected NixOS host can gain full administrative control of the MySQL instance, exposing all databases to read, modify, and destroy operations.

Affected Products

Nixpkgs channels prior to 25.11 using services.mysql with mysql
Nixpkgs channels prior to 26.05 using services.mysql with percona-server
NixOS systems hosting shared workloads such as web or CGI processes on the same host as MySQL

Discovery Timeline

2026-07-15 - CVE-2026-61828 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-61828

Vulnerability Analysis

The NixOS services.mysql module provisions the initial MySQL data directory during first activation. When the configured package is mysql or percona-server, the initialization procedure leaves the root@localhost account without a password and grants access over the local UNIX socket to any user on the system. This defeats the standard assumption that only privileged accounts can reach MySQL administrative interfaces.

Any local process, including low-privileged accounts used to run web applications, CGI scripts, or scheduled jobs, can open the MySQL socket and issue commands as root. From that context, an attacker can read every database, alter authentication tables, install user-defined functions, or drop data. The impact is confined to the local host, but it collapses the separation between service accounts and the database administrative boundary.

Root Cause

The root cause is incorrect default permissions [CWE-276] in the services.mysql NixOS module's initialization logic. The module produced a MySQL data directory whose root grant tables permitted passwordless local login instead of restricting administrative access to the system root account or an explicitly provisioned credential.

Attack Vector

Exploitation requires local access with any shell or code-execution primitive on the affected host. An attacker connects to the local MySQL socket, authenticates as root without credentials, and runs arbitrary SQL. Adjacent vulnerabilities such as a web application flaw that yields command execution as the web user become a direct path to full database compromise. The vulnerability details are described in the GitHub Security Advisory GHSA-6qxx-6rg8-c4p8.

Detection Methods for CVE-2026-61828

Indicators of Compromise

MySQL root@localhost sessions originating from non-administrative UNIX users, visible in SHOW PROCESSLIST output or the MySQL general query log.
Creation of new MySQL users, grant modifications, or CREATE FUNCTION statements not tied to a change ticket.
Unexpected mysql client invocations spawned from web server, PHP-FPM, or CGI process trees.

Detection Strategies

Audit the MySQL mysql.user table on affected hosts for a root@localhost entry with an empty authentication_string and plugin set to auth_socket mapped to non-system users.
Enable the MySQL general query log or audit plugin and alert on root logins that do not originate from the system root UID.
Correlate process telemetry with database connections to identify non-DBA users establishing sessions to the local MySQL socket.

Monitoring Recommendations

Forward MySQL authentication and query logs to a centralized logging platform for retention and search.
Track file access to /run/mysqld/mysqld.sock and flag readers outside the expected service accounts.
Monitor NixOS activation events for changes to the services.mysql module and verify post-activation grant state.

How to Mitigate CVE-2026-61828

Immediate Actions Required

Upgrade Nixpkgs to a channel that includes the 25.11 or 26.05 fix and rebuild the NixOS system.
Immediately set a strong password for root@localhost and remove any anonymous or passwordless grants on affected instances.
Review all local user accounts and web-facing services on the host and rotate any secrets that may have been exposed through the database.

Patch Information

The fix is included in the 25.11 and 26.05 Nixpkgs channels. The relevant commits are 3f68d7ad2a6865ff8b4910d89f173d7258bad8dd, 4aed47116a8734922763cd8f477467b0a0bcd6d7, and f8ee41468a7a8f9ed3a8cc7d017151c2ca6f90b5. Corresponding pull requests are tracked as PR #534254, PR #534482, and PR #534484.

Workarounds

Manually reset the MySQL root@localhost credential and drop any grant that permits passwordless local authentication until the patched module can be deployed.
Restrict access to the MySQL UNIX socket using filesystem permissions so only trusted service accounts can connect.
Isolate MySQL from co-tenant workloads by moving web, CGI, or application processes to a separate host or container until the system is rebuilt against a fixed channel.

bash

# Configuration example - reset root and remove passwordless local access
sudo mysql -u root <<'SQL'
ALTER USER 'root'@'localhost' IDENTIFIED BY 'REPLACE_WITH_STRONG_PASSWORD';
DELETE FROM mysql.user WHERE User='' OR authentication_string='';
FLUSH PRIVILEGES;
SQL