CVE-2026-110453
Description
A flaw was found in Nix. When running in an unsandboxed configuration on macOS or FreeBSD, the service incorrectly permits connections initiated by build users to daemon clients. A local attacker or malicious build process could exploit this vulnerability to interact directly with the daemon, potentially compromising the integrity of build operations.
Statement
Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.
Understanding the Weakness (CWE)
Access Control
Technical Impact: Gain Privileges or Assume Identity; Bypass Protection Mechanism
The exploitation of a weakness in low-privileged areas of the software can be leveraged to reach higher-privileged areas without having to overcome any additional obstacles, extending the scope of the damage to higher-privileged users..
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
