# CVE-2026-110452: Nix multi-user installer improper file ownership

Source: https://junglewise.ai/threats/cve-2026-110452-the-multi-user-installer-in-nix-before-2-35-3-sets-the-ownership  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-14. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-110452 · Severity: medium · CVSS 4 · Published 2026-10-14

Nix is a package manager that manages software dependencies and deployment. The multi-user installer incorrectly sets store contents to be owned by the invoking user instead of root, allowing that user to potentially modify or corrupt packages used system-wide. This affects fresh multi-user installations but not NixOS systems or users who have already upgraded.

Technologies: [Nixos Nix](https://junglewise.ai/threats/technologies/nix). Vendors: [Nixos](https://junglewise.ai/threats/vendors/nixos).

## Quick answers

**Is CVE-2026-110452 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-110452 being exploited in the wild.

**How severe is CVE-2026-110452?** Medium severity, with a CVSS score of 4, published 14 October 2026.

**Which products and versions are affected?** Nixos Nix before 2.35.3, 2.34.9, 2.31.6, 2.30.6, 2.28.8.

**Is there a fix for CVE-2026-110452?** Yes: fixed in Nix 2.35.3, 2.34.9, 2.31.6, 2.30.6, 2.28.8. Until then: Check for bad ownership manually using the instructions in the NixOS GitHub Security Advisory. If you have upgraded nix via nix upgrade-nix and performed garbage collection on the initial generation, you are likely not affected. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-110452 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-110452?** Check whether you run Nixos Nix at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Nix 2.35.3, 2.34.9, 2.31.6, 2.30.6, 2.28.8

Check for bad ownership manually using the instructions in the NixOS GitHub Security Advisory. If you have upgraded nix via nix upgrade-nix and performed garbage collection on the initial generation, you are likely not affected.

## Technical details

The multi-user installer script in Nix sets incorrect ownership on store contents, leaving them owned by the invoking user rather than root. This is a file permission issue in the initial bootstrap closure that affects fresh installations from https://nixos.org/nix/install with the --daemon flag. The vulnerability does not affect systems that have upgraded nix via nix upgrade-nix and performed garbage collection.

## Affected products

- NixOS Nix before 2.35.3, 2.34.9, 2.31.6, 2.30.6, 2.28.8

## Timeline

- 2026-10-13: disclosed
- 2026-10-14: advisory: CVE-2026-110452 published on NVD

## References

- [https://discourse.nixos.org/t/security-advisory-for-nix-and-lix-october-2026/80547](https://discourse.nixos.org/t/security-advisory-for-nix-and-lix-october-2026/80547)

## Related threats

- [Nix daemon improper authorization of clients on macOS and FreeBSD](https://junglewise.ai/threats/cve-2026-110453-nix-before-2-35-3-when-unsandboxed-on-macos-or-freebsd)
- [Nix Seatbelt sandbox escape on macOS](https://junglewise.ai/threats/cve-2026-110451-nix-before-2-35-3-and-lix-before-2-95-4-on-macos-allow-a)
- [Nix privilege escalation via repair operation](https://junglewise.ai/threats/cve-2026-110450-nix-before-2-35-3-and-lix-before-2-95-4-allow-privilege)
- [Nix integer overflow in list allocation](https://junglewise.ai/threats/cve-2026-110449-nix-before-2-35-3-and-lix-before-2-95-4-have-an-integer-overflow)
- [Nix package manager time-of-check/time-of-use in symlink handling](https://junglewise.ai/threats/cve-2026-64846-nix-package-manager-time-of-check-time-of-use-in-symlink-handling)