Is CVE-2026-110453 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-110453 being exploited in the wild.

How severe is CVE-2026-110453?

Medium severity, with a CVSS score of 4.3, published 14 October 2026.

Which products and versions are affected?

Nixos Nix ≤2.35.2, ≤2.34.8, ≤2.31.5, ≤2.30.5, ≤2.28.7.

Is there a fix for CVE-2026-110453?

Yes: fixed in Nix 2.35.3, 2.34.9, 2.31.6, 2.30.6, 2.28.8. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-110453 attacked?

It is attacked with local access.

Am I affected by CVE-2026-110453?

Check whether you run Nixos Nix at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-110453: Nix daemon improper authorization of clients on macOS and FreeBSD

CVE-2026-110453 · Severity: medium · CVSS 4.3 · Published 2026-10-14

Nix is a package manager used to declaratively manage software environments and dependencies. When running unsandboxed on macOS or FreeBSD, the Nix daemon fails to properly authorize connections from build users, allowing privilege escalation when combined with other vulnerabilities. An attacker with local access could exploit this to gain unauthorized access to system resources or execute arbitrary code.

Technologies: Nixos Nix. Vendors: Nixos.

Quick answers

Is CVE-2026-110453 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-110453 being exploited in the wild.
How severe is CVE-2026-110453?: Medium severity, with a CVSS score of 4.3, published 14 October 2026.
Which products and versions are affected?: Nixos Nix ≤2.35.2, ≤2.34.8, ≤2.31.5, ≤2.30.5, ≤2.28.7.
Is there a fix for CVE-2026-110453?: Yes: fixed in Nix 2.35.3, 2.34.9, 2.31.6, 2.30.6, 2.28.8. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-110453 attacked?: It is attacked with local access.
Am I affected by CVE-2026-110453?: Check whether you run Nixos Nix at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Nix 2.35.3, 2.34.9, 2.31.6, 2.30.6, 2.28.8

Technical details

This is an improper authorization vulnerability in the Nix daemon's client authentication logic on macOS and FreeBSD systems when sandboxing is disabled. The daemon fails to reject connections from build users, which can be leveraged in conjunction with unprivileged repair operations (CVE-2026-110450) to achieve local privilege escalation. The vulnerability only manifests on unsandboxed macOS and FreeBSD configurations; Linux and sandboxed macOS installations are not affected.

Affected products

NixOS Nix ≤2.35.2, ≤2.34.8, ≤2.31.5, ≤2.30.5, ≤2.28.7

Timeline

2026-10-14: disclosed

References

https://discourse.nixos.org/t/security-advisory-for-nix-and-lix-october-2026/80547

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.