What is CVE-2026-44592?

CVE-2026-44592 is a critical-severity vulnerability in Wavelens Gradient, classified under Missing Authentication for Critical Function. CVSS score: 9.4/10. Published 2026-05-14.

How severe is CVE-2026-44592?

Critical severity. CVSS v3 base score is 9.4 out of 10.

Auth bypass in Wavelens Gradient

CVE-2026-44592

Gradient is a nix-based continuous integration system. In 1.1.0, when GRADIENT_DISCOVERABLE=true (the default, and the NixOS module default), anyone who can reach /proto can register as a worker without any credentials by sending a fresh…

Vulnerability class: Broken Authentication

EPSS: 0.000 (6.6th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.4 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H.

Affected products

Wavelens Gradient — versions 1.1.0

Weakness classification (CWE)

CWE-306 — Missing Authentication for Critical Function
CWE-345 — Insufficient Verification of Data Authenticity
CWE-862 — Missing Authorization

References

security-advisories@github.com (x_refsource_CONFIRM)

Frequently asked questions

What is CVE-2026-44592?: CVE-2026-44592 is a critical-severity vulnerability in Wavelens Gradient, classified under Missing Authentication for Critical Function. CVSS score: 9.4/10. Published 2026-05-14.
How severe is CVE-2026-44592?: Critical severity. CVSS v3 base score is 9.4 out of 10.