CVE-2026-110450

Executive Summary

CVE-2026-110450 is a privilege escalation vulnerability in the Nix package manager (versions before 2.35.3) and the Lix fork of Nix (versions before 2.95.4). The flaw is an ordering error (CWE-696) in the store‑path repair operation: the repair logic destroys and then replaces a store path before verifying its content, allowing a local actor to substitute unverified content and thereby escalate privileges. Fixed releases are Nix 2.35.3 and Lix 2.95.4; no public exploit or PoC is known at this time.

Technical Analysis

The vulnerability resides in the store repair functionality of the Nix package manager and its Lix fork. Nix maintains a content‑addressed store where every path has a cryptographic hash that is supposed to guarantee integrity. The nix-store --repair-path operation (or equivalent repair routine) is designed to re‑download or rebuild a store path when its content is missing or corrupt.

According to the NVD description, the defect is an incorrect operation ordering: “a repair operation … could destroy and then replace a store path before content verification.” In normal secure design, a store path must first be verified against its declared hash (content verification) before any replacement of the existing path is committed. Here, the sequence is inverted — the existing path is first destroyed, then a replacement is written, and only afterwards is content verified. Because the destructive step occurs before verification, an attacker who can influence the replacement content (for example, by providing a crafted substitute store path) can cause unverified, attacker‑controlled content to occupy the store path. The arithmetic of the check‑then‑use order is broken (CWE‑696: Incorrect Behavior Order).

The CVSS vector CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L (score 8.0) indicates the following characteristics:

• Attack Vector (Local): the attacker must already have local access to the machine, or the ability to invoke the repair operation locally.
• Attack Complexity (Low): no special conditions beyond normal race or ordering exploitation.
• Privileges Required (None): the attacker does not need prior privileges on the system.
• User Interaction (None): no victim action is required.
• Scope (Unchanged): the impact stays within the same security authority.
• Confidentiality (High), Integrity (High), Availability (Low): the flaw can lead to high confidentiality and integrity loss, with some availability impact (the store path is destroyed before the malicious replacement, which could break dependent builds).

The affected Nix store is a central component for system configuration management in NixOS and for development environments using Nix. Because store paths are often consumed by privileged build or activation processes (for example, nixos-rebuild switch or systemd services referencing store paths), a local user who can influence the repair can plant content that is later executed with higher privileges, resulting in privilege escalation.

No specific function names beyond the general “repair operation” are provided in the NVD text. Therefore, the code‑level explanation must remain at the level of the known behavior: an ordering flaw between destruction, replacement, and verification of store paths.

Exploitation Scenarios

No public PoC is available; the following attack chain is inferred strictly from the vulnerability class described in NVD: “a repair operation … could destroy and then replace a store path before content verification.”

1. Reconnaissance / Target Identification:
   The attacker gains local access to a system that uses Nix or Lix (for example, a multi‑user NixOS host, CI runner, or developer workstation). They identify a store path that is subject to a repair operation — commonly triggered automatically during nix-store --repair-path or when a build or channel update attempts to fix a corrupted store path. The attacker determines which store paths are repaired and when, focusing on those that are later consumed by privileged processes.

2. Triggering the Specific Flaw Class:
   The attacker causes the repair operation to run on a target store path while providing (or arranging for) a replacement whose content does not match the original hash. Because the repair logic destroys the existing path and writes the replacement before verification, the malicious content temporarily (or permanently, depending on subsequent privileges) occupies the store path. The flaw class is an ordering error that defeats the integrity guarantee that content verification is meant to provide.

3. Payload / Execution Method:
   At the vulnerability‑class level, the payload is a crafted replacement for a store path. Because the verification step occurs too late, the attacker‑supplied content is now present under a path that is expected to be trusted. If that path is later executed, loaded, or used in a privileged context (for example, as part of a system activation or a service definition), the attacker‑controlled content runs with the privileges of that context. The precise mechanism of influence (e.g., whether the attacker supplies a local substitute or leverages a crafted build input) is not specified in the NVD description and must not be fabricated here.

4. Post‑Exploitation Impact:
   Successful exploitation yields high confidentiality and integrity impact: the attacker may read sensitive data, modify system configuration, or run arbitrary code with elevated privileges. The availability impact (Low) reflects the initial destruction of the store path, which can break builds or services until the malicious replacement is executed or cleaned up. Overall, the flaw turns a local foothold into a privilege escalation vector.

No known threat actor campaigns or in‑the‑wild exploitation have been observed or reported for CVE-2026-110450 as of this writing (CISA KEV: NO; no exploit code or Nuclei template available).

Impact Assessment

The CVSS score of 8.0 (High) reflects a serious local privilege escalation with no authentication or user interaction required. The affected systems are any host using Nix before 2.35.3 or Lix before 2.95.4 — including NixOS installations, multi‑user Nix deployments, continuous integration systems using Nix, and development containers. Because the Nix store is often part of the trusted computing base for system configuration, compromise of a store path can have a high blast radius: an attacker can affect every subsequent build, service, or user that consumes that path. The local attack vector limits remote exploitation, but on shared systems (e.g., CI runners, shared dev servers) a low‑privileged user can escalate to a more privileged context. The integrity and confidentiality impacts are both rated High, while availability impact is Low — reflecting the transient destruction of a store path before the malicious replacement is installed.

Detection Guidance

Sigma Rule

title: Local Store Path Repair Ordering Exploitation Attempt
id: 8a3c9d1e-2f4b-4c5a-9d6e-7f8a9b0c1d2e
status: experimental
description: Detects unusual execution of nix-store repair operations followed by modification of store paths, consistent with CVE-2026-110450 ordering flaw.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-110450
author: Threat Intelligence Team
date: 2026-01-01
tags:
  - attack.privilege_escalation
  - attack.t1068
logsource:
  product: linux
  service: auditd
detection:
  selection_process:
    Image|endswith:
      - '/nix-store'
      - '/nix'
    CommandLine|contains:
      - '--repair-path'
      - '--repair'
  selection_suspicious:
    CommandLine|contains:
      - '/nix/store/'
  condition: selection_process and selection_suspicious
falsepositives:
  - Legitimate repair operations by system administrators
level: medium

YARA Rule

rule CVE_2026_110450_Nix_Repair_Ordering
{
    meta:
        description = "Detects attempts to abuse Nix/Lix store path repair ordering (CVE-2026-110450)"
        author = "Threat Intelligence Team"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-110450"
        severity = "high"

    strings:
        $repair = "repair-path" ascii wide nocase
        $nixstore = "/nix/store/" ascii wide
        $nixbin = "nix-store" ascii wide nocase
        $lixbin = "lix" ascii wide nocase
        $orderflaw = "destroy" ascii wide nocase
        $verify = "verify" ascii wide nocase

    condition:
        uint32(0) == 0x464c457f and  // ELF file
        ( $nixbin or $lixbin ) and
        ( $repair and $nixstore ) and
        ( $orderflaw or $verify )
}

Suricata IDS Rule

alert tcp $HOME_NET any -> $HOME_NET any (msg:"CVE-2026-110450 Nix/Lix repair path ordering exploitation attempt"; flow:to_server,established; content:"nix-store"; nocase; content:"--repair-path"; nocase; distance:0; content:"/nix/store/"; nocase; distance:0; classtype:attempted-admin; reference:cve,2026-110450; sid:2026110450; rev:1;)

Note: the rule targets local repair invocation patterns that may be transmitted over a local management interface; adapt thresholds to your environment.

Elastic Detection

process where process.name in ("nix-store", "nix", "lix") and
  process.args : ("*--repair-path*", "*--repair*") and
  process.args : "*/nix/store/*"

Splunk SPL Query

index=linux sourcetype=auditd OR sourcetype=syslog
(process_name="nix-store" OR process_name="nix" OR process_name="lix")
(process_command_line="*--repair-path*" OR process_command_line="*--repair*")
process_command_line="*/nix/store/*"
| stats count min(_time) as first_seen max(_time) as last_seen by host, user, process_command_line
| where count > 0

Wazuh OSSEC Rule

<group name="nix_repair_exploit,">
  <rule id="100450" level="12">
    <decoded_as>json</decoded_as>
    <field name="process.name">nix-store|nix|lix</field>
    <field name="process.args">--repair-path|--repair</field>
    <field name="process.args">/nix/store/</field>
    <description>CVE-2026-110450: Possible Nix/Lix store path repair ordering exploitation attempt</description>
    <mitre>
      <id>T1068</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). The NVD description states that the issue is fixed in Nix 2.35.3 and Lix 2.95.4, but no vendor advisory or commit references are tracked in the provided data.

1. Immediate Mitigations

   • Restrict local access: ensure that only trusted administrators can invoke repair operations (e.g., by controlling membership in the nix-users group or equivalent).
   • Avoid running repair operations on multi‑user systems where untrusted local users have access. If repair is necessary, perform it from a single‑user, isolated session.
   • Monitor logs for unexpected nix-store --repair-path invocations and for sudden changes to store path contents.
   • Apply the principle of least privilege: do not run privileged builds or activations that consume store paths as root without additional verification.

2. Patch / Upgrade Steps

   • Upgrade to Nix 2.35.3 or later; upgrade Lix to 2.95.4 or later. These versions are stated in the NVD description as the fixed releases. Because no patch source is currently tracked, verify the exact fixed versions and availability through the official Nix and Lix release channels before rolling out.
   • After upgrading, re‑verify the integrity of the store and monitor for any lingering unauthorized store content.

3. Long‑Term Hardening

   • Implement continuous integrity monitoring of the Nix store (e.g., periodic hash verification of critical store paths).
   • Review the repair workflow to ensure that in future designs, content verification always precedes any destructive replacement of a store path.
   • Consider running Nix builds and repairs in isolated sandboxes (e.g., containers, VMs) to limit the impact of a local privilege escalation.
   • Stay informed of updates from the Nix and Lix projects; as this is an ordering flaw, related fixes may appear in subsequent releases.

References

1. NVD — CVE-2026-110450: https://nvd.nist.gov/vuln/detail/CVE-2026-110450
2. Nix project releases (Nix 2.35.3): https://github.com/NixOS/nix/releases
3. Lix project releases (Lix 2.95.4): https://github.com/lix-project/lix/releases
4. CWE-696: Incorrect Behavior Order — https://cwe.mitre.org/data/definitions/696.html
5. CISA Known Exploited Vulnerabilities Catalog (not listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No public PoC, exploit code, or threat actor campaign has been observed for CVE-2026-110450.