High severity · published Aug 27, 2024
CVE-2024-45049
Nix Hydra Missing authentication when triggering evaluations
7.5
CVSS
0.6%
EPSS
No
On KEV
Description
Hydra is a Continuous Integration service for Nix based projects. It is possible to trigger evaluations in Hydra without any authentication. Depending on the size of evaluations, this can impact the availability of systems. The problem can be fixed by applying https://github.com/NixOS/hydra/commit/f73043378907c2c7e44f633ad764c8bdd1c947d5 to any Hydra package. Users are advised to upgrade. Users unable to upgrade should deny the `/api/push` route in a reverse proxy. This also breaks the "Evaluate jobset" button in the frontend.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 50% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HY
hydra · NixOS
< f73043378907c2c7e44f633ad764c8bdd1c947d5 · source: vendor, NVD, CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-45049
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-45049
Patch
https://github.com/NixOS/hydra/commit/f73043378907c2c7e44f633ad764c8bdd1c947d5
Patch
https://github.com/NixOS/hydra/security/advisories/GHSA-xv29-v93r-2f5v
Issue Tracking
https://github.com/NixOS/nixpkgs/pull/337766
Third Party Advisory
https://mastodon.delroth.net/@delroth/113029832631860419
More from hydra
7.5
CVE-2025-54864
Hydra missing authentication when triggering evaluations through GitHub and Gitea plugins
6.1
CVE-2025-54800
Hydra persistent XSS in build metrics
5.4
CVE-2024-32657
Hydra has persistent XSS vulnerability serving HTML build outputs
2.6
CVE-2025-32435
Hydra no restricted eval after nix-eval-jobs migration