CVE-2026-61828 NixOS CVE debrief

Who should care

Defenders managing Nixpkgs installations, especially those using MySQL services with mysql or percona-server, should assess exposure and apply patches. This includes reviewing local user access and permissions, monitoring for suspicious activity in MySQL services, and verifying the presence of affected systems. Additionally, defenders should review official advisories and apply patches or mitigations as needed.

Why it matters

CVE-2026-61828 allows local users to log in as root without a password in Nixpkgs MySQL services; defenders should verify and apply patches.

• Local users can log in as root without a password
• Potential for lateral movement and privilege escalation
• Need for verification and patching of Nixpkgs MySQL services

Technical summary

The Nixpkgs MySQL services module initializes the MySQL database in a way that allows local users to log in as the root user without a password when using mysql or percona-server. This issue is fixed in the 25.11 and 26.05 channels. The vulnerability exists due to the insecure initialization of the MySQL database by the Nixpkgs MySQL services module. This allows unprivileged local users to gain root access without a password. Defenders should verify and apply patches to mitigate this vulnerability. The CVE record and NVD detail page provide information on the vulnerability, while source references offer insights into the fixes and patches available.

Defensive priority

Defenders should prioritize verifying and applying patches for Nixpkgs MySQL services, especially in environments where local user access is a concern.

Recommended defensive actions

• Verify and apply patches for Nixpkgs MySQL services
• Review local user access and permissions
• Monitor for suspicious activity in MySQL services
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD detail page provide information on the vulnerability, while source references offer insights into the fixes and patches available. The Nixpkgs MySQL services module initializes the MySQL database in a way that allows local users to log in as the root user without a password when using mysql or percona-server. This issue is fixed in the 25.11 and 26.05 channels. Defenders should verify the presence of affected systems, review official advisories, and apply patches or mitigations as needed. The vulnerability is a

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.