CVE-2026-110452

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-110452", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "state": "PUBLISHED", "assignerShortName": "mitre", "dateReserved": "2026-10-14T04:12:27.246Z", "datePublished": "2026-10-14T04:12:28.499Z", "dateUpdated": "2026-10-14T17:27:51.579Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Nix", "vendor": "NixOS", "versions": [{"lessThan": "2.28.8", "status": "affected", "version": "0", "versionType": "semver"}, {"lessThan": "2.30.6", "status": "affected", "version": "2.29.0", "versionType": "semver"}, {"lessThan": "2.31.6", "status": "affected", "version": "2.31.0", "versionType": "semver"}, {"lessThan": "2.34.9", "status": "affected", "version": "2.32.0", "versionType": "semver"}, {"lessThan": "2.35.3", "status": "affected", "version": "2.35.0", "versionType": "semver"}]}], "descriptions": [{"lang": "en", "value": "The multi-user installer in Nix before 2.35.3 sets the ownership of store contents to the user (who invoked the installer) even though it should be root ownership."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 4, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-708", "description": "CWE-708 Incorrect Ownership Assignment", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-10-14T04:12:28.499Z"}, "references": [{"url": "https://discourse.nixos.org/t/security-advisory-for-nix-and-lix-october-2026/80547"}], "x_generator": {"engine": "CVE-Request-form 0.0.1"}, "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:nixos:nix:*:*:*:*:*:*:*:*", "versionEndExcluding": "2.28.8"}, {"vulnerable": true, "criteria": "cpe:2.3:a:nixos:nix:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.29.0", "versionEndExcluding": "2.30.6"}, {"vulnerable": true, "criteria": "cpe:2.3:a:nixos:nix:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.31.0", "versionEndExcluding": "2.31.6"}, {"vulnerable": true, "criteria": "cpe:2.3:a:nixos:nix:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.32.0", "versionEndExcluding": "2.34.9"}, {"vulnerable": true, "criteria": "cpe:2.3:a:nixos:nix:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.35.0", "versionEndExcluding": "2.35.3"}]}]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-14T17:25:47.770441Z", "id": "CVE-2026-110452", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-14T17:27:51.579Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-110452", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-14T17:25:47.770441Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-14T17:25:59.691Z"}}], "cna": {"metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "NixOS", "product": "Nix", "versions": [{"status": "affected", "version": "0", "lessThan": "2.28.8", "versionType": "semver"}, {"status": "affected", "version": "2.29.0", "lessThan": "2.30.6", "versionType": "semver"}, {"status": "affected", "version": "2.31.0", "lessThan": "2.31.6", "versionType": "semver"}, {"status": "affected", "version": "2.32.0", "lessThan": "2.34.9", "versionType": "semver"}, {"status": "affected", "version": "2.35.0", "lessThan": "2.35.3", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://discourse.nixos.org/t/security-advisory-for-nix-and-lix-october-2026/80547"}], "x_generator": {"engine": "CVE-Request-form 0.0.1"}, "descriptions": [{"lang": "en", "value": "The multi-user installer in Nix before 2.35.3 sets the ownership of store contents to the user (who invoked the installer) even though it should be root ownership."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-708", "description": "CWE-708 Incorrect Ownership Assignment"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:nixos:nix:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "2.28.8"}, {"criteria": "cpe:2.3:a:nixos:nix:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "2.30.6", "versionStartIncluding": "2.29.0"}, {"criteria": "cpe:2.3:a:nixos:nix:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "2.31.6", "versionStartIncluding": "2.31.0"}, {"criteria": "cpe:2.3:a:nixos:nix:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "2.34.9", "versionStartIncluding": "2.32.0"}, {"criteria": "cpe:2.3:a:nixos:nix:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "2.35.3", "versionStartIncluding": "2.35.0"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-10-14T04:12:28.499Z"}}}, "cveMetadata": {"cveId": "CVE-2026-110452", "state": "PUBLISHED", "dateUpdated": "2026-10-14T17:27:51.579Z", "dateReserved": "2026-10-14T04:12:27.246Z", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2026-10-14T04:12:28.499Z", "assignerShortName": "mitre"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Nix", "vendor": "NixOS", "versions": [{"lessThan": "2.28.8", "status": "affected", "version": "0", "versionType": "semver"}, {"lessThan": "2.30.6", "status": "affected", "version": "2.29.0", "versionType": "semver"}, {"lessThan": "2.31.6", "status": "affected", "version": "2.31.0", "versionType": "semver"}, {"lessThan": "2.34.9", "status": "affected", "version": "2.32.0", "versionType": "semver"}, {"lessThan": "2.35.3", "status": "affected", "version": "2.35.0", "versionType": "semver"}]}], "source": "cve@mitre.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The multi-user installer in Nix before 2.35.3 sets the ownership of store contents to the user (who invoked the installer) even though it should be root ownership."}], "id": "CVE-2026-110452", "lastModified": "2026-10-16T19:56:15.773", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 4.0, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.5, "impactScore": 1.4, "source": "cve@mitre.org", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-110452", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-14T17:25:47.770441Z", "version": "2.0.3"}}]}, "published": "2026-10-14T05:16:43.220", "references": [{"source": "cve@mitre.org", "url": "https://discourse.nixos.org/t/security-advisory-for-nix-and-lix-october-2026/80547"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-708"}], "source": "cve@mitre.org", "type": "Secondary"}]}

{"bugzilla": {"description": "nix: nix: Unauthorized file modification via improper multi-user installer ownership", "id": "2552072", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2552072"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "status": "draft"}, "cwe": "CWE-708", "details": ["The multi-user installer in Nix before 2.35.3 sets the ownership of store contents to the user (who invoked the installer) even though it should be root ownership.", "A flaw was found in nix. The multi-user installer incorrectly assigns ownership of Nix store contents to the user who ran the installation rather than to root. A local user who executed the installer can modify files within the Nix store, leading to unauthorized modification of installed software components."], "name": "CVE-2026-110452", "public_date": "2026-10-14T04:12:28Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-110452\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-110452\nhttps://discourse.nixos.org/t/security-advisory-for-nix-and-lix-october-2026/80547"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,2.28.8)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.29.0,2.30.6)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.31.0,2.31.6)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.32.0,2.34.9)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.35.0,2.35.3)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Nix", "source": "cna", "vendor": "NixOS"}, "product": "nix", "vendor": "nixos"}], "created": "2026-10-14T16:45:04.092383+00:00", "title": "Nix Multi-User Installer Grants User-Owned Packages Instead of Root", "updated": "2026-10-17T11:15:07.475396+00:00", "vendors": ["nixos", "nixos$PRODUCT$nix"]}