Is CVE-2026-110452 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-110452 being exploited in the wild.

How severe is CVE-2026-110452?

Medium severity, with a CVSS score of 4, published 14 October 2026.

Which products and versions are affected?

Nixos Nix before 2.35.3, 2.34.9, 2.31.6, 2.30.6, 2.28.8.

How is CVE-2026-110452 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-110452?

Check whether you run Nixos Nix at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-110452: Nix multi-user installer improper file ownership

CVE-2026-110452 · Severity: medium · CVSS 4 · Published 2026-10-14

Nix is a package manager that manages software dependencies and deployment. The multi-user installer incorrectly sets store contents to be owned by the invoking user instead of root, allowing that user to potentially modify or corrupt packages used system-wide. This affects fresh multi-user installations but not NixOS systems or users who have already upgraded.

Technologies: Nixos Nix. Vendors: Nixos.

Quick answers

Is CVE-2026-110452 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-110452 being exploited in the wild.
How severe is CVE-2026-110452?: Medium severity, with a CVSS score of 4, published 14 October 2026.
Which products and versions are affected?: Nixos Nix before 2.35.3, 2.34.9, 2.31.6, 2.30.6, 2.28.8.
Is there a fix for CVE-2026-110452?: Yes: fixed in Nix 2.35.3, 2.34.9, 2.31.6, 2.30.6, 2.28.8. Until then: Check for bad ownership manually using the instructions in the NixOS GitHub Security Advisory. If you have upgraded nix via nix upgrade-nix and performed garbage collection on the initial generation, you are likely not affected. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-110452 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-110452?: Check whether you run Nixos Nix at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Nix 2.35.3, 2.34.9, 2.31.6, 2.30.6, 2.28.8

Check for bad ownership manually using the instructions in the NixOS GitHub Security Advisory. If you have upgraded nix via nix upgrade-nix and performed garbage collection on the initial generation, you are likely not affected.

Technical details

The multi-user installer script in Nix sets incorrect ownership on store contents, leaving them owned by the invoking user rather than root. This is a file permission issue in the initial bootstrap closure that affects fresh installations from https://nixos.org/nix/install with the --daemon flag. The vulnerability does not affect systems that have upgraded nix via nix upgrade-nix and performed garbage collection.

Affected products

NixOS Nix before 2.35.3, 2.34.9, 2.31.6, 2.30.6, 2.28.8

Timeline

2026-10-13: disclosed
2026-10-14: advisory: CVE-2026-110452 published on NVD

References

https://discourse.nixos.org/t/security-advisory-for-nix-and-lix-october-2026/80547

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.