CVE-2026-61828

The record

Nixpkgs is a collection of software packages that can be installed with the Nix package manager. Prior to the 25.11 and 26.05 channel fixes, the NixOS module for MySQL services.mysql initializes the MySQL database in a way that allows local users, such as unprivileged web or CGI processes on the same host, to log in as the root user without a password when the service is used with mysql or percona-server. This issue is fixed in the 25.11 and 26.05.

Affected packages

Related vulnerabilities

• CVE-2026-107052 Insecure permissions in the AIDL interface of ProjectMAXS MAXS Module FileRead… CWE-276
• CVE-2026-114148 Incorrect default permissions in ASP.NET Core allows an authorized attacker to elevate… CWE-276
• CVE-2026-112357 GFI KerioConnect (Kerio Connect) Outlook Connector (Offline Edition), 'KOFF', before… CWE-276
• CVE-2026-115253 An incorrect permission assignment vulnerability in the WatchGuard Agent's log directory… CWE-276
• CVE-2026-11813 A potential improper permissions vulnerability was reported in the Lenovo Filez Client… CWE-276
• CVE-2026-52766 YesWiki is a wiki system written in PHP. CWE-276
• CVE-2026-77393 In Ignition 8.1.53 and earlier, the Gateway "Create Project Role(s)" setting shipped… CWE-276
• CVE-2026-75166 Insecure Permission vulnerability in MBS-Solutions X-Serie Gateway firmware V6_00_05… CWE-276