Vulnerability record · CVE-2026-61828 · published 15 July 2026

CVE-2026-61828: Incorrect default permissions vulnerability

Nixpkgs is a collection of software packages that can be installed with the Nix package manager. Prior to the 25.11 and 26.05 channel fixes, the NixOS module for MySQL services.mysql initializes the MySQL database in a way that allows local users, such as unprivileged web or CGI processes on the same host, to log in as the root user without a password when the service is used with mysql or percona-server. This issue is fixed in the 25.11 and 26.05.

8.5 CVSS 4.0 High EPSS 0.15% · top 96.3% CWE-276 · Incorrect default permissions Deferred

8.5CVSS 4.0 base score

0.15%EPSS exploitation probability, 30 days

NoNot in CISA KEV

0Affected product versions listed by NVD

7References

15 Jul 2026Last modified by NVD

Description

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

References

Link	Tags
https://github.com/NixOS/nixpkgs/commit/3f68d7ad2a6865ff8b4910d89f173d7258bad8dd
https://github.com/NixOS/nixpkgs/commit/4aed47116a8734922763cd8f477467b0a0bcd6d7
https://github.com/NixOS/nixpkgs/commit/f8ee41468a7a8f9ed3a8cc7d017151c2ca6f90b5
https://github.com/NixOS/nixpkgs/pull/534254
https://github.com/NixOS/nixpkgs/pull/534482
https://github.com/NixOS/nixpkgs/pull/534484
https://github.com/NixOS/nixpkgs/security/advisories/GHSA-6qxx-6rg8-c4p8

Track CVE-2026-61828 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.8CVE-2026-87886Acronis Backup plugins for cPanel, Plesk and DirectAdmin local privilege escalationAcronis Backup plugins for cPanel & WHM, Plesk and DirectAdmin on Linux ship with insecure file permissions (CWE-276), allowing a local user to escal…KEVEPSS 0.23%analysed17 Sep 2026 6.5CVE-2022-22948VMware vCenter Server information disclosure via incorrect file permissionsvCenter Server ships files with incorrect default permissions, allowing a user with non-administrative access to read sensitive information. Because …KEVEPSS 13%analysed29 Mar 2022 9.8CVE-2013-0632Adobe ColdFusion RDS default password authentication bypassAdobe ColdFusion 9.0 through 10 ships administrator.cfc with an RDS component that accepts a default empty password. An attacker can log in to RDS wi…KEVEPSS 94%analysed17 Jan 2013

Source: NIST National Vulnerability Database (record CVE-2026-61828), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.