CVE-2026-61828

HighCVSS 8.5/10Last modified Oct 24, 2026

Description

Nixpkgs is a collection of software packages that can be installed with the Nix package manager. Prior to the 25.11 and 26.05 channel fixes, the NixOS module for MySQL services.mysql initializes the MySQL database in a way that allows local users, such as unprivileged web or CGI processes on the same host, to log in as the root user without a password when the service is used with mysql or percona-server. This issue is fixed in the 25.11 and 26.05.

Metrics

CVSS 4.0 8.5/10

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-276

Affected software

No affected versions have been published.

Timeline

Published: Jul 15, 2026
Last modified: Oct 24, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-61837.3A security flaw has been discovered in code-projects Simple Content Management System 1.0. Affected by this issue is some unknown functional CVE-2026-618338.1zot is a container image and artifact registry based on the Open Container Initiative Distribution Specification. Prior to 2.1.18, the beare CVE-2026-618344.3scim-patch is a library for applying SCIM patch operations. Prior to 0.9.2, navigate() reads inherited properties and assign() uses prototyp CVE-2026-618357.7Directus is a real-time API and App dashboard for managing SQL database content. Prior to 12.0.0, the SSRF protection on Directus's file-imp CVE-2026-618368.6Directus is a real-time API and App dashboard for managing SQL database content. Prior to 12.0.0, when response caching is enabled, the cach CVE-2026-618375.3RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.3.3, 4.2.9, 4.1.14, and 4.0.23, AMQP 1.0 management GET /bindings exposes f CVE-2026-618388.2Lychee is a free, open-source photo-management tool. Prior to 7.6.3, GET /api/v2/Zip authorizes album and photo archives through AlbumPolicy CVE-2026-61842.4A weakness has been identified in code-projects Simple Content Management System 1.0. This affects an unknown part of the file /web/admin/we CVE-2026-618426.5Grav is a file-based Web platform. Prior to 2.0.2, the Grav Twig content sandbox permits grav.offsetGet('config') to return the raw configur CVE-2026-618438.2FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.18.0, FileRise upload-ena CVE-2026-618447.1FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.18.0, FileRise flattens l CVE-2026-618516.5Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.