PatchSiren cyber security CVE debrief

CVE-2026-110453 NixOS CVE debrief

CVE-2026-110453 is a vulnerability in Nix before 2.35.3 that allows unauthorized connections made by build users from daemon clients when unsandboxed on macOS or FreeBSD. This medium-severity issue may lead to potential unauthorized connections, increased risk of lateral movement, and elevated privileges in certain scenarios. Defenders responsible for Nix deployments on these platforms should assess exposure and implement mitigations promptly. The vulnerability exists due to incorrect handling of connections in unsandboxed environments, emphasizing the need for sandboxing and careful configuration management.

Vendor: NixOS
Product: Nix
CVSS: MEDIUM 4.3
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-10-14
Original CVE updated: 2026-10-14
Advisory published: 2026-10-14
Advisory updated: 2026-10-14

Who should care

Defenders responsible for Nix deployments on macOS and FreeBSD systems should assess exposure and implement mitigations. This includes verifying Nix versions, implementing sandboxing, and monitoring daemon client connections and build user activities to mitigate potential risks associated with this vulnerability. Security teams and vulnerability management teams should also review and update their configurations to 2

Why it matters

CVE-2026-110453 is a medium-severity vulnerability in Nix that allows unauthorized connections when unsandboxed on macOS or FreeBSD. Defenders should verify Nix versions, implement sandboxing, and monitor daemon client connections to mitigate potential risks.

Potential unauthorized connections from build users
Increased risk of lateral movement in affected environments
Need for verification of Nix versions and configurations
Potential for elevated privileges in certain scenarios

Technical summary

The vulnerability in Nix before 2.35.3 allows connections made by build users from daemon clients when unsandboxed on macOS or FreeBSD. This issue arises from the incorrect handling of connections in unsandboxed environments, potentially leading to unauthorized access and increased risk. Defenders should prioritize verifying Nix versions and configurations, especially on macOS and FreeBSD systems, and consider implementing sandboxing to mitigate potential risks.

Defensive priority

Defenders should prioritize verifying Nix versions and configurations, especially on macOS and FreeBSD systems.

Recommended defensive actions

Verify Nix versions and configurations on macOS and FreeBSD systems
Implement sandboxing for Nix on affected platforms
Monitor Nix daemon client connections and build user activities

Evidence notes

The CVE record and source item provide details on the vulnerability, but additional information from vendor sources may be necessary for comprehensive risk assessment.

Sources and references

Verified primary and authoritative sources

CVE-2026-110453 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2026-110453

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2026-110453 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2026-110453

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

CVE-2026-110453
Unverified legacy reference

URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/110xxx/CVE-2026-110453.json

cve_program_cvelist_v5
Source reference
Unverified legacy reference

URL: https://discourse.nixos.org/t/security-advisory-for-nix-and-lix-october-2026/80547

Supplemental source

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.