What is CVE-2026-25137?

CVE-2026-25137 is a critical-severity vulnerability in Nixos Nixpkgs, classified under Files or Directories Accessible to External Parties. CVSS score: 9.1/10. Published 2026-02-02.

How severe is CVE-2026-25137?

Critical severity. CVSS v3 base score is 9.1 out of 10.

Auth bypass in Nixos Nixpkgs

CVE-2026-25137

The NixOs Odoo package is an open source ERP and CRM system. From 21.11 to before 25.11 and 26.05, every NixOS based Odoo setup publicly exposes the database manager without any authentication. This allows unauthorized actors to delete and…

EPSS: 0.000 (11.9th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.1 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H.

Affected products

Nixos Nixpkgs — versions >= 21.11, < 25.11

Weakness classification (CWE)

References

https://github.com/NixOS/nixpkgs/security/advisories/GHSA-cwmq-6wv5-f3px (x_refsource_CONFIRM)
https://github.com/NixOS/nixpkgs/pull/485310 (x_refsource_MISC)
https://github.com/NixOS/nixpkgs/pull/485454 (x_refsource_MISC)

Frequently asked questions

What is CVE-2026-25137?: CVE-2026-25137 is a critical-severity vulnerability in Nixos Nixpkgs, classified under Files or Directories Accessible to External Parties. CVSS score: 9.1/10. Published 2026-02-02.
How severe is CVE-2026-25137?: Critical severity. CVSS v3 base score is 9.1 out of 10.