CVE-2026-44592 Details
Description
Gradient is a nix-based continuous integration system. In 1.1.0, when GRADIENT_DISCOVERABLE=true (the default, and the NixOS module default), anyone who can reach /proto can register as a worker without any credentials by sending a fresh, never-registered worker UUID. The resulting session has PeerAuth::Open, i.e. it sees jobs from every organisation, and can immediately NarPush/NarUploaded arbitrary store paths into nar_storage and the cached_path table. This vulnerability is fixed in 1.1.1.
A vulnerability in Gradient, a nix-based continuous integration system, allows unauthenticated registration of workers in version 1.1.0. When the environment variable GRADIENT_DISCOVERABLE is set to true, the default setting, anyone who can access the /proto endpoint can register as a worker by sending a new, unregistered worker UUID. The registered worker session is granted open peer authentication, enabling access to jobs from all organizations. This exploitation allows the worker to push and upload arbitrary store paths into the nar_storage and cached_path tables, effectively poisoning the cache. This vulnerability has been patched in version 1.1.1.
The vulnerability has been fixed in Gradient version 1.1.1. Until the update can be applied, set the GRADIENT_DISCOVERABLE environment variable to false and restrict the /proto endpoint access to known worker IPs.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 14, 2026CISA-ADP
Assessed May 16, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/wavelens/gradient/security/advisories/GHSA-49w6-gf3p-96m2 | [email protected] | AdvisoryExploitRemedyTechnical AnalysisVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-306 | Missing Authentication for Critical Function | [email protected] |
| CWE-345 | Insufficient Verification of Data Authenticity | [email protected] |
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Gradient | All versions |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 14, 2026 | New CVE Received | [email protected] |