CyberRota Analysis
AI-GeneratedThe NixOS module for MySQL services in Nixpkgs prior to versions 25.11 and 26.05 allows local users, including unprivileged web or CGI processes, to access the MySQL database as the root user without a password. This vulnerability poses a significant security risk as it could enable unauthorized access and manipulation of the database. Organizations using affected versions of NixOS with MySQL should prioritize upgrading to the fixed versions to mitigate potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Nixpkgs is a collection of software packages that can be installed with the Nix package manager. Prior to the 25.11 and 26.05 channel fixes, the NixOS module for MySQL services.mysql initializes the MySQL database in a way that allows local users, such as unprivileged web or CGI processes on the same host, to log in as the root user without a password when the service is used with mysql or percona-server. This issue is fixed in the 25.11 and 26.05.