Vulnerability · Published Jul 15, 2026 · Assigned by GitHub_M

CVE-2026-61828nixos/mysql : `services.mysql` is configured with insecure authentication by default when used with `mysql` or `percona-server`

High 8.5

In plain English

A high-severity incorrect default permissions in nixpkgs from NixOS. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 4% of all known vulnerabilities).

Severity (CVSS 4.0)8.5High

Exploit odds (30 days)0.2%top 95.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Nixpkgs is a collection of software packages that can be installed with the Nix package manager. Prior to the 25.11 and 26.05 channel fixes, the NixOS module for MySQL services.mysql initializes the MySQL database in a way that allows local users, such as unprivileged web or CGI processes on the same host, to log in as the root user without a password when the service is used with mysql or percona-server. This issue is fixed in the 25.11 and 26.05.

Affected products (as reported)

Vendor	Product	Versions
NixOS	nixpkgs	< 25.11>= 26.05-beta, < 26.05

Weakness: CWE-276 · Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

https://github.com/NixOS/nixpkgs/security/advisories/GHSA-6qxx-6rg8-c4p8 x_refsource_CONFIRM
https://github.com/NixOS/nixpkgs/pull/534254 x_refsource_MISC
https://github.com/NixOS/nixpkgs/pull/534482 x_refsource_MISC
https://github.com/NixOS/nixpkgs/pull/534484 x_refsource_MISC
https://github.com/NixOS/nixpkgs/commit/3f68d7ad2a6865ff8b4910d89f173d7258bad8dd x_refsource_MISC
https://github.com/NixOS/nixpkgs/commit/4aed47116a8734922763cd8f477467b0a0bcd6d7 x_refsource_MISC
https://github.com/NixOS/nixpkgs/commit/f8ee41468a7a8f9ed3a8cc7d017151c2ca6f90b5 x_refsource_MISC