Auth bypass in Nixos Hydra
CVE-2025-54864
Hydra is a continuous integration service for Nix based projects. Prior to commit f7bda02, /api/push-github and /api/push-gitea are called by the corresponding forge without HTTP Basic authentication. Both forges do however feature HMAC signing with a secret key. Triggering an evaluation can be very taxing on the infrastructure when large evaluations are done, introducing potential denial of service attacks on the host running the evaluator. This issue has been patched by commit f7bda02. A workaround involves blocking /api/push-github and /api/push-gitea via a reverse proxy.
Vulnerability class: Broken Authentication
EPSS: 0.004 (30.8th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
Affected products
- Nixos Hydra — versions < f7bda020c6144913f134ec616783e57817f7686f
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security-advisories@github.com (x_refsource_CONFIRM, Patch, Vendor Advisory)
- security-advisories@github.com (Patch, x_refsource_MISC)
Frequently asked questions
- What is CVE-2025-54864?
- CVE-2025-54864 is a high-severity vulnerability in Nixos Hydra, classified under Missing Authentication for Critical Function. CVSS score: 7.5/10. Published 2025-08-12.
- How severe is CVE-2025-54864?
- High severity. CVSS v3 base score is 7.5 out of 10.
- Is CVE-2025-54864 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.