CVE-2026-110452 in Nix
Summary
by MITRE • 10/14/2026
The multi-user installer in Nix before 2.35.3 sets the ownership of store contents to the user (who invoked the installer) even though it should be root ownership.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/14/2026
A critical privilege escalation vulnerability exists within the installation logic of the Nix package manager prior to version 2.35.3, specifically affecting multi-user installations on Unix-like operating systems. The flaw resides in how the installer handles file system permissions and ownership for the Nix store directory, which is a central component responsible for storing all installed packages and their dependencies. When an unprivileged user initiates the installation process without root privileges or through a mechanism that does not properly elevate credentials during the finalization phase, the resulting files within the Nix store are assigned to the invoking user rather than the system root account as intended by the security model of multi-user setups. This deviation from the expected state creates a significant gap in the isolation guarantees provided by the package manager, allowing any local user with write access to the installation directory to potentially compromise the integrity and availability of software for all other users on the same host.
The technical root cause is an improper assignment of file ownership during the post-installation configuration steps. In a secure multi-user Nix deployment, the store must be owned by root to prevent non-administrative users from modifying or replacing binaries and libraries that are shared across user sessions. By setting the owner to the invoking user, the installer inadvertently grants this individual full control over the entire package repository. This misconfiguration effectively neutralizes the sandboxing and isolation mechanisms designed into Nix, as an attacker can overwrite system-wide tools, inject malicious code into shared dependencies, or delete critical components required by other users. The vulnerability is particularly dangerous because it occurs during a routine administrative task that may be performed with limited privileges under the assumption that subsequent steps will enforce correct permissions automatically.
From an operational perspective, this flaw enables several severe attack vectors aligned with common threat models in enterprise environments. An attacker who gains access to a low-privilege account can exploit this condition to achieve local privilege escalation by modifying system binaries or scripts that are executed with higher privileges later. This aligns directly with the MITRE ATT&CK technique of T1548, which covers Abuse of Elevation Control Mechanisms, as well as CWE-269 regarding Improper Privilege Management. Furthermore, because Nix is often used in continuous integration and deployment pipelines where multiple users or service accounts interact with shared build environments, this vulnerability can lead to supply chain compromises if an attacker alters a dependency that is subsequently pulled by other processes or developers. The integrity of the software delivery pipeline is thus compromised at its foundational layer, allowing for silent data corruption or backdoor insertion without immediate detection.
Mitigation strategies must address both the immediate remediation and long-term architectural safeguards. Organizations should immediately upgrade to Nix version 2.35.3 or later, where this ownership assignment logic has been corrected to ensure root ownership is enforced regardless of the invoking user's identity. For environments that cannot update immediately due to compatibility constraints, manual verification of file ownership in the Nix store directory is required; administrators should recursively chown the store contents to root and verify that group permissions restrict write access to non-root users only. Additionally, implementing strict filesystem monitoring using tools like auditd can help detect unauthorized changes to package files post-installation. Security teams should also review their installation scripts to ensure they do not rely on implicit privilege assumptions and instead explicitly enforce security policies during the setup phase, thereby closing the gap between user intent and system enforcement.