CVE-2026-61828
nixos/mysql : `services.mysql` is configured with insecure authentication by default when used with `mysql` or `percona-server`
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
Nixpkgs is a collection of software packages that can be installed with the Nix package manager. Prior to the 25.11 and 26.05 channel fixes, the NixOS module for MySQL services.mysql initializes the MySQL database in a way that allows local users, such as unprivileged web or CGI processes on the same host, to log in as the root user without a password when the service is used with mysql or percona-server. This issue is fixed in the 25.11 and 26.05.
| CWE | CWE-276 |
| Vendor | nixos |
| Product | nixpkgs |
| Published | Jul 15, 2026 |
| Last Updated | Jul 15, 2026 |
Stay Ahead of the Next One
Get instant alerts for nixos nixpkgs
Be the first to know when new unknown vulnerabilities affecting nixos nixpkgs are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
NixOS / nixpkgs
< 25.11 >= 26.05-beta, < 26.05
References
github.com: https://github.com/NixOS/nixpkgs/security/advisories/GHSA-6qxx-6rg8-c4p8 github.com: https://github.com/NixOS/nixpkgs/pull/534254 github.com: https://github.com/NixOS/nixpkgs/pull/534482 github.com: https://github.com/NixOS/nixpkgs/pull/534484 github.com: https://github.com/NixOS/nixpkgs/commit/3f68d7ad2a6865ff8b4910d89f173d7258bad8dd github.com: https://github.com/NixOS/nixpkgs/commit/4aed47116a8734922763cd8f477467b0a0bcd6d7 github.com: https://github.com/NixOS/nixpkgs/commit/f8ee41468a7a8f9ed3a8cc7d017151c2ca6f90b5