What is CVE-2026-25137?

CVE-2026-25137 is a critical-severity vulnerability in Nixos Nixpkgs, classified under Missing Authentication for Critical Function. CVSS score: 9.1/10. Published 2026-02-02.

How severe is CVE-2026-25137?

Critical severity. CVSS v3 base score is 9.1 out of 10.

Auth bypass in Nixos Nixpkgs

CVE-2026-25137

The NixOs Odoo package is an open source ERP and CRM system. From 21.11 to before 25.11 and 26.05, every NixOS based Odoo setup publicly exposes the database manager without any authentication. This allows unauthorized actors to delete and…

Vulnerability class: Broken Authentication

EPSS: 0.095 (94.9th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.1 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H.

Affected products

Nixos Nixpkgs — versions >= 21.11, < 25.11

Weakness classification (CWE)

References

security-advisories@github.com (x_refsource_CONFIRM)
security-advisories@github.com (x_refsource_MISC)
security-advisories@github.com (x_refsource_MISC)

Frequently asked questions

What is CVE-2026-25137?: CVE-2026-25137 is a critical-severity vulnerability in Nixos Nixpkgs, classified under Missing Authentication for Critical Function. CVSS score: 9.1/10. Published 2026-02-02.
How severe is CVE-2026-25137?: Critical severity. CVSS v3 base score is 9.1 out of 10.