CVE-2026-61828 Details

A vulnerability exists in the Nixpkgs MySQL module for NixOS versions prior to 25.11 and 26.05. The issue allows local users, including unprivileged web or CGI processes, to log in as the root user without a password when using MySQL or Percona Server. This vulnerability arises because the MySQL database is initialized with insecure authentication by default, permitting unauthorized access to the root account. The problem is exacerbated by the fact that existing deployments will not be automatically fixed, potentially leaving systems vulnerable.

Users can manually secure the root user by logging into MySQL as the root user and executing the command 'ALTER USER root@localhost IDENTIFIED WITH auth_socket;'. This command configures the root user to use socket-based authentication, which requires no password for local connections. Alternatively, if non-root users need to access MySQL as root, a password can be set for the root account. For new deployments, the MySQL module will use socket authentication by default, but this change does not apply to existing deployments on NixOS versions prior to 26.11.