9

CVE-2026-39860: nixos nix UNIX Symbolic Link (Symlink) Following

CVSS: 9.0v3.1CriticalAnalyzed
AliasesUBUNTU-CVE-2026-39860DEBIAN-CVE-2026-39860
Published 08-04-2026Last modified 09-04-2026
Open JSON

Vulnerability summary

CVE-2026-39860 is a critical (CVSS 9.0) UNIX Symbolic Link (Symlink) Following vulnerability in nixos nix. EPSS estimates a 0.18% chance of exploitation in the next 30 days, higher than 7% of scored vulnerabilities.

Overall risk
70/100
0100
High · default modelHow is this calculated?
CVSS score
9.0/10
010
Critical · v3.1 (CVE.org)
EPSS score
0.18%
0%100%
Low · -0.01 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Timeline

  1. 08-04-2026
    PublishedVulnerability first disclosed.
  2. 09-04-2026
    Last modifiedVulnerability information updated.

Description

Nix is a package manager for Linux and other Unix systems. A bug in the fix for CVE-2024-27297 allowed for arbitrary overwrites of files writable by the Nix process orchestrating the builds (typically the Nix daemon running as root in multi-user installations) by following symlinks during fixed-output derivation output registration. This affects sandboxed Linux builds - sandboxed macOS builds are unaffected. The location of the temporary output used for the output copy was located inside the build chroot. A symlink, pointing to an arbitrary location in the filesystem, could be created by the derivation builder at that path. During output registration, the Nix process (running in the host mount namespace) would follow that symlink and overwrite the destination with the derivation's output contents. In multi-user installations, this allows all users able to submit builds to the Nix daemon (allowed-users - defaulting to all users) to gain root privileges by modifying sensitive files. This vulnerability is fixed in 2.34.5, 2.33.4, 2.32.7, 2.31.4, 2.30.4, 2.29.3, and 2.28.6.

CVSS metrics

4 scores · 4 sources · 1 version

EPSS trend

Probability

0.18%

Chance of exploitation in the next 30 days

Percentile

7%

Versus all other CVEs

30-day change

-0.01 pp

From 0.19% on 21-09-2026

21-09-202621-10-2026
EPSS score
0.18%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Debian1 product
  • nixAll versions (No fix recorded) | < 2.34.6+dfsg-1
Nixos1 product
  • nix≥ 2.21, < 2.28.6 | ≥ 2.18.2, ≤ 2.18.9 | ≥ 2.19.4, ≤ 2.19.7 | ≥ 2.20.5, ≤ 2.20.9 | ≥ 2.21.0, < 2.28.6 | ≥ 2.29.0, < 2.29.3 | ≥ 2.30.0, < 2.30.4 | ≥ 2.31.0, < 2.31.4 | ≥ 2.32.0, < 2.32.7 | ≥ 2.33.0, < 2.33.4 | ≥ 2.34.0, < 2.34.5
Ubuntu1 product
  • nixAll versions (No fix recorded)

3 vendors · 3 products

References

9 links