CVE-2026-110452
The multi-user installer in Nix before 2.35.3 sets the ownership of store contents to the user (who invoked the installer) even though it should be root ownership.
Published Oct 14, 2026 · updated Oct 14, 2026
The multi-user installer in Nix before 2.35.3 sets the ownership of store contents to the user (who invoked the installer) even though it should be root ownership.
Timeline
Detection, updates, and resolution for this record.
Oct 14, 2026 · NIST NVD
Detected
The multi-user installer in Nix before 2.35.3 sets the ownership of store contents to the user (who invoked the installer) even though it should be root ownership.
Oct 14, 2026 · NIST NVD
Updated
The multi-user installer in Nix before 2.35.3 sets the ownership of store contents to the user (who invoked the installer) even though it should be root ownership.
Sources
- CVE.orgCVE-2026-110452
Official CVE identifier
cve.org - FIRST EPSSCVE-2026-110452
30-day exploitation probability 0.1%
first.org - NIST NVDCVE-2026-110452
The multi-user installer in Nix before 2.35.3 sets the ownership of store contents to the user (who invoked the installer) even though it should be root ownership.
nvd.nist.gov