Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
4.0
CVE-2026-110452: Nix installer gives wrong file ownership, allowing tampering
CVE-2026-110452 · published 22 days ago
Summary
On Debian, the Nix package manager installer before version 2.35.3 incorrectly makes the installing user own files that should belong to the system administrator. This could let a regular user change or replace software components that are meant to be protected. Update Nix to version 2.35.3 or later to restore correct ownership.
What to do
- Update nixos nix to version 2.28.8 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:12 | debian | nix | All versions |
| – | nixos | nix | < 2.28.8 |
| Ubuntu:Pro:22.04:LTS | canonical | nix | All versions |
Original advisory text
DEBIAN-CVE-2026-110452
The multi-user installer in Nix before 2.35.3 sets the ownership of store contents to the user (who invoked the installer) even though it should be root ownership.
References
- https://discourse.nixos.org/t/security-advisory-for-nix-and-lix-october-2026/805... Third Party Advisory
- https://security-tracker.debian.org/tracker/CVE-2026-110452 Vendor Advisory
- https://ubuntu.com/security/CVE-2026-110452 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-110452 Third Party Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-708Incorrect Ownership Assignment
Timeline
Published14 Oct 2026
Updated26 Oct 2026
First seen14 Oct 2026
Sources
CVE-2026-110452 · NVD
DEBIAN-CVE-2026-110452 · OSV
CVE-2026-110452 · MITRE
UBUNTU-CVE-2026-110452 · OSV
Track software like this
Free during beta